ElastiCache Redis auto-upgrades minor versions

Check ID: elasticache_redis_cluster_auto_minor_version_upgrades
Provider: AWS
Service: elasticache
Severity: HIGH
Resource type: Other

What this check verifies

ElastiCache for Redis replication groups are configured to apply automatic minor engine upgrades using AutoMinorVersionUpgrade

Risk

Without automatic minor upgrades, Redis nodes may run versions with known CVEs and stability bugs, enabling unauthorized access, replication inconsistencies, or crashes. Delayed patching widens the attack window and lengthens maintenance, degrading confidentiality, integrity, and availability.

Recommendation

Enable AutoMinorVersionUpgrade for Redis replication groups and govern updates with a maintenance window. Apply patch management and defense in depth: validate in staging, keep recent backups, use Multi-AZ for resilience, and monitor release notes to ensure timely, low-impact updates.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws elasticache modify-replication-group —replication-group-id <replication_group_id> —auto-minor-version-upgrade —apply-immediately

# Enable auto minor version upgrades on an ElastiCache replication group
resource "aws_elasticache_replication_group" "<example_resource_name>" {
  replication_group_id       = "<example_resource_id>"
  description                = "<example_description>"
  node_type                  = "<example_node_type>"
  num_cache_clusters         = 1
  auto_minor_version_upgrade = true  # CRITICAL: automatically applies minor engine upgrades
}

# CloudFormation: enable auto minor version upgrades on a Replication Group
Resources:
  <example_resource_name>:
    Type: AWS::ElastiCache::ReplicationGroup
    Properties:
      ReplicationGroupDescription: "<example_description>"
      CacheNodeType: "<example_node_type>"
      NumCacheClusters: 1
      AutoMinorVersionUpgrade: true  # CRITICAL: turns on automatic minor version upgrades
      # This ensures new minor engine versions are applied automatically

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elasticache_redis_cluster_auto_minor_version_upgrades. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

ElastiCache cluster is not using public subnets ElastiCache Redis cluster has automatic failover enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires