RDS cluster has automatic minor version upgrades enabled

Check ID: rds_cluster_minor_version_upgrade_enabled
Provider: AWS
Service: rds
Severity: MEDIUM
Categories: vulnerabilities
Resource type: AwsRdsDbCluster

What this check verifies

RDS Multi-AZ DB clusters are configured for automatic minor engine upgrades via auto_minor_version_upgrade. The evaluation checks these clusters to see if this setting is enabled so preferred minor releases are applied during the maintenance window.

Risk

Without automatic minor upgrades, clusters can miss security patches, enabling exploitation of known flaws (confidentiality). Unfixed defects may corrupt data (integrity) or trigger crashes and failovers (availability). Emergency patching raises downtime and operational risk.

Recommendation

Enable auto_minor_version_upgrade on RDS Multi-AZ clusters and align updates with approved maintenance windows. Validate changes in non-production, and document any exceptions with a strict manual patch cadence. This strengthens defense in depth and improves availability.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws rds modify-db-cluster —db-cluster-identifier <example_resource_id> —auto-minor-version-upgrade

# Terraform snippet to enable automatic minor version upgrades on an RDS DB cluster
resource "aws_rds_cluster" "<example_resource_name>" {
  cluster_identifier         = "<example_resource_id>"
  auto_minor_version_upgrade = true  # Critical: enables automatic minor engine version upgrades to pass the check
}

# CloudFormation snippet to enable automatic minor version upgrades on an RDS DB cluster
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBCluster
    Properties:
      AutoMinorVersionUpgrade: true  # Critical: enables automatic minor engine version upgrades to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_cluster_minor_version_upgrade_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

RDS cluster has CloudWatch Logs export enabled RDS cluster has Multi-AZ enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires