DMS replication instance auto-upgrades minor versions

Check ID: dms_instance_minor_version_upgrade_enabled
Provider: AWS
Service: dms
Severity: MEDIUM
Categories: vulnerabilities
Resource type: AwsDmsReplicationInstance

What this check verifies

AWS DMS replication instances are evaluated for the auto_minor_version_upgrade setting to confirm automatic minor engine updates are enabled during the maintenance window.

Risk

Without automatic minor upgrades, DMS engines can miss security patches and fixes, enabling exploitation of known flaws and instability.

Confidentiality: exposure via unpatched components
Integrity: replication errors or data drift
Availability: outages during migration or CDC

Recommendation

Enable auto_minor_version_upgrade on all replication instances to maintain continuous patching.

Set a maintenance window and validate in non-prod
Monitor release notes and health metrics
Enforce least privilege for change control
Keep backups for rollback

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws dms modify-replication-instance —region <REGION> —replication-instance-arn arn:aws:dms:<REGION>:<ACCOUNT_ID>:rep:<REPLICATION_ID> —auto-minor-version-upgrade —apply-immediately

# Terraform: Enable auto minor version upgrade on a DMS replication instance
resource "aws_dms_replication_instance" "<example_resource_name>" {
  replication_instance_id    = "<example_resource_id>"
  replication_instance_class = "dms.t3.micro"
  auto_minor_version_upgrade = true  # CRITICAL: turns on automatic minor version upgrades
}

# CloudFormation: Enable auto minor version upgrade on a DMS replication instance
Resources:
  <example_resource_name>:
    Type: AWS::DMS::ReplicationInstance
    Properties:
      ReplicationInstanceIdentifier: <example_resource_id>
      ReplicationInstanceClass: dms.t3.micro
      AutoMinorVersionUpgrade: true  # CRITICAL: turns on automatic minor version upgrades

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = dms_instance_minor_version_upgrade_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

DMS endpoint has SSL enabled DMS replication instance has Multi-AZ enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires