Repository: cloud-custodian/cloud-custodian

Issue:
AWS.RDS cannot enable enhanced monitoring or performance insights
**Describe the bug**
I'm trying to run through all of our RDS instances and turn on Enhanced Monitoring and Performance Insights.  It throws an error on each.

**Enhanced Monitoring:**
botocore.exceptions.ClientError: An error occurred (InvalidParameterCombination) when calling the ModifyDBInstance operation: A MonitoringRoleARN value is required if you specify a MonitoringInterval value other than 0.
--I see nowhere to enter the MonitoringRoleArn

**Performance Insights**
  File "/Users/greg.mayer/custodian/lib/python3.7/site-packages/c7n/resources/rds.py", line 1640, in process
    if r[update['property']] != update['value']:
KeyError: 'EnablePerformanceInsights'

**To Reproduce**
I run the following yaml.  Can comment out whichever you are testing
_custodian run -s . rds-enable-perf-insights.yaml_
```yaml
policies:
  - name: enable-rds-perf-insights
    resource: rds
    filters:
      - PerformanceInsightsEnabled: false
      - tag:Team: aa-gm
    actions:
      - type: modify-db
        update:
          - property: 'PerformanceInsightsKMSKeyId'
            value: (default) aws/rds
          - property: 'EnablePerformanceInsights'
            value: true
          - property: 'MonitoringInterval'
            value: 60
        immediate: true
```

**Expected behavior**
I would expect the necessary actions, MonitoringRoleArn and EnablePerformanceInsights, to be available and to work properly to allow for updating existing RDS DB.


**Background (please complete the following information):**
 - OS: OSX 10.15.2
 - Python Version: Python 3.7.2
 - Custodian Version: 0.8.46.1
 - Tool Version: n/a
 - Cloud Provider: aws
 - Policy: 
admin user
*:*
 - Traceback: [if applicable, please exclude sensitive/account information]

**Additional context**
Add any other context about the problem here.



Discussion:
the monitoring error is from the api, in that it wants an a role arn also specified. the perf insights issue looks like something that needs to be corrected in the action code.
That is correct about the monitoring role arn.  It must be added to the schema portion (line 1616) of rds.py to allow us to use it.  I have modified mine manually.

`                        'MonitoringInterval',
                        'MonitoringRoleArn',
                        'DBPortNumber',`
Thanks!

Resolving patch:
diff --git a/c7n/resources/rds.py b/c7n/resources/rds.py
--- a/c7n/resources/rds.py
+++ b/c7n/resources/rds.py
@@ -1611,6 +1611,7 @@ class ModifyDb(BaseAction):
                         'Domain',
                         'CopyTagsToSnapshot',
                         'MonitoringInterval',
+                        'MonitoringRoleARN',
                         'DBPortNumber',
                         'PubliclyAccessible',
                         'DomainIAMRoleName',
@@ -1630,6 +1631,16 @@ class ModifyDb(BaseAction):
 
     permissions = ('rds:ModifyDBInstance',)
 
+    def validate(self):
+        if self.data.get('update'):
+            update_dict = dict((i['property'], i['value']) for i in self.data.get('update'))
+            if ('MonitoringInterval' in update_dict and update_dict['MonitoringInterval'] > 0 and
+                    'MonitoringRoleARN' not in update_dict):
+                raise PolicyValidationError(
+                    "A MonitoringRoleARN value is required \
+                    if you specify a MonitoringInterval value other than 0")
+        return self
+
     def process(self, resources):
         c = local_session(self.manager.session_factory).client('rds')
 


Test patch: