MQ broker has automated minor version upgrades enabled

Check ID: mq_broker_auto_minor_version_upgrades
Provider: AWS
Service: mq
Severity: LOW
Categories: vulnerabilities
Resource type: AwsAmazonMQBroker

What this check verifies

Amazon MQ brokers have autoMinorVersionUpgrade enabled to automatically apply supported minor and patch engine updates during the scheduled maintenance window.

Risk

Without automatic minor upgrades, brokers may run known-vulnerable engine versions, enabling exploits that impact:

Confidentiality: message disclosure
Integrity: tampering or replay
Availability: crashes/DoS and instability

Delayed patches also increase operational risk and drift.

Recommendation

Enable autoMinorVersionUpgrade on all brokers to reduce patch latency.

Align upgrades with a defined maintenance window
Validate changes in staging before production
Monitor broker health and logs after updates
Maintain HA and tested backups for rollback (defense in depth)

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws mq update-broker —broker-id <example_resource_id> —auto-minor-version-upgrade

# Terraform: Enable automatic minor version upgrades on an MQ broker
resource "aws_mq_broker" "<example_resource_name>" {
  broker_name                = "<example_resource_name>"
  engine_type                = "ActiveMQ"
  engine_version             = "<ENGINE_VERSION>"
  host_instance_type         = "mq.t3.micro"
  publicly_accessible        = true
  auto_minor_version_upgrade = true  # Critical: enables automatic minor version upgrades

  user {
    username = "<USERNAME>"
    password = "<PASSWORD>"
  }
}

# CloudFormation: Enable automatic minor version upgrades on an MQ broker
Resources:
  <example_resource_name>:
    Type: AWS::AmazonMQ::Broker
    Properties:
      BrokerName: <example_resource_name>
      AutoMinorVersionUpgrade: true  # Critical: enables automatic minor version upgrades
      DeploymentMode: SINGLE_INSTANCE
      EngineType: ACTIVEMQ
      EngineVersion: <ENGINE_VERSION>
      HostInstanceType: mq.t3.micro
      PubliclyAccessible: true
      Users:
        - Username: <USERNAME>
          Password: <PASSWORD>

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = mq_broker_auto_minor_version_upgrades. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

ActiveMQ broker uses active/standby Multi-AZ mode MQ RabbitMQ broker has cluster (multi-AZ) deployment mode

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires