Control: 3.2.2 Ensure the Auto Minor Version Upgrade feature is enabled for RDS instances
Description
Ensure that RDS database instances have the Auto Minor Version Upgrade flag enabled to automatically receive minor engine upgrades during the specified maintenance window. This way, RDS instances can obtain new features, bug fixes, and security patches for their database engines.
Remediation
From Console:
- Log in to the AWS management console and navigate to the RDS dashboard at https://console.aws.amazon.com/rds/.
- In the left navigation panel, click
Databases
. - Select the RDS instance that you want to update.
- Click on the
Modify
button located at the top right side. - On the
Modify DB Instance: <instance identifier>
page, In theMaintenance
section, selectAuto minor version upgrade
and click theYes
radio button. - At the bottom of the page, click
Continue
, and checkApply Immediately
to apply the changes immediately, or selectApply during the next scheduled maintenance window
to avoid any downtime. - Review the changes and click
Modify DB Instance.
The instance status should change from available to modifying and back to available. Once the feature is enabled, theAuto Minor Version Upgrade
status should change toYes
.
From Command Line:
- Run the
describe-db-instances
command to list all RDS database instance names available in the selected AWS region:
aws rds describe-db-instances --region <region-name> --query 'DBInstances[*].DBInstanceIdentifier'
- The command output should return each database instance identifier.
- Run the
modify-db-instance
command to modify the configuration of a selected RDS instance. This command will apply the changes immediately.
Remove --apply-immediately
to apply changes during the next scheduled maintenance window and avoid any downtime:
aws rds modify-db-instance --region <region-name> --db-instance-identifier <db-instance-identifier> --auto-minor-version-upgrade --apply-immediately
- The command output should reveal the new configuration metadata for the RDS instance, including the
AutoMinorVersionUpgrade
parameter value. - Run the
describe-db-instances
command to check if the Auto Minor Version Upgrade feature has been successfully enabled:
aws rds describe-db-instances --region <region-name> --db-instance-identifier <db-instance-identifier> --query 'DBInstances[*].AutoMinorVersionUpgrade'
- The command output should return the feature's current status set to true, indicating that the feature is
enabled
, and that the minor engine upgrades will be applied to the selected RDS instance.
Default Value:
By default, new Amazon RDS instances have the Auto Minor Version Upgrade option enabled, unless explicitly disabled at creation or modification.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.cis_v600_3_2_2
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.cis_v600_3_2_2 --share
SQL
This control uses a named query:
select arn as resource, case when auto_minor_version_upgrade then 'ok' else 'alarm' end as status, case when auto_minor_version_upgrade then title || ' automatic minor version upgrades enabled.' else title || ' automatic minor version upgrades not enabled.' end as reason , region, account_idfrom aws_rds_db_instance;