MemoryDB cluster auto-upgrades minor versions

Check ID: memorydb_cluster_auto_minor_version_upgrades
Provider: AWS
Service: memorydb
Severity: MEDIUM
Categories: vulnerabilities
Resource type: Other

What this check verifies

MemoryDB clusters are evaluated for the auto_minor_version_upgrade setting that automatically applies new minor engine versions.

Risk

Without automatic minor upgrades, clusters may run known-vulnerable engine versions.

Exploitable CVEs enable unauthorized reads/writes (confidentiality, integrity)
Unpatched bugs can cause DoS or data loss (availability)
Version drift raises operational risk and slows incident response

Recommendation

Enable automatic minor version upgrades (auto_minor_version_upgrade=true) for all clusters. Schedule updates in a maintenance window, validate in staging, and keep rollback plans. Apply defense in depth with strict ACLs and monitoring to limit exposure between releases.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws memorydb update-cluster —cluster-name <cluster-name> —auto-minor-version-upgrade

resource "aws_memorydb_cluster" "<example_resource_name>" {
  name       = "<example_resource_name>"
  acl_name   = "<example_acl_name>"
  node_type  = "<example_node_type>"
  num_shards = 1

  auto_minor_version_upgrade = true  # Critical: enables automatic minor version upgrades
}

# Enable automatic minor version upgrades for a MemoryDB cluster
Resources:
  <example_resource_name>:
    Type: AWS::MemoryDB::Cluster
    Properties:
      ClusterName: <example_resource_name>
      ACLName: <example_acl_name>
      NodeType: <example_node_type>
      NumShards: 1
      AutoMinorVersionUpgrade: true  # Critical: enables automatic minor version upgrades

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = memorydb_cluster_auto_minor_version_upgrades. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Amazon Macie is enabled ActiveMQ broker uses active/standby Multi-AZ mode

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires