RDS instance uses a supported engine version

Check ID: rds_instance_deprecated_engine_version
Provider: AWS
Service: rds
Severity: HIGH
Categories: vulnerabilities
Resource type: AwsRdsDbInstance

What this check verifies

RDS DB instances use a supported, non-deprecated engine version for MariaDB, MySQL, or PostgreSQL. The instance’s engine and engine_version are evaluated against versions currently supported in the region.

Risk

Deprecated engine versions lack security fixes and support, enabling exploitation of known flaws impacting confidentiality and integrity. Availability can suffer from forced maintenance or failed upgrades.

Unpatched CVEs
TLS/client incompatibilities
Replication or backup/restore issues

Recommendation

Standardize on supported engine versions and keep them current.

Plan and test upgrades; back up and define rollback
Enable AutoMinorVersionUpgrade where acceptable
Monitor deprecation notices and upgrade before EoS
Enforce least privilege to limit blast radius during incidents

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws rds modify-db-instance —db-instance-identifier <DB_INSTANCE_ID> —engine-version <SUPPORTED_ENGINE_VERSION> —allow-major-version-upgrade —apply-immediately

# Upgrade RDS engine version
resource "aws_db_instance" "<example_resource_name>" {
  identifier         = "<example_resource_id>"
  engine             = "<engine>"
  instance_class     = "db.t3.micro"
  allocated_storage  = 20

  engine_version               = "<SUPPORTED_ENGINE_VERSION>"  # CRITICAL: use a supported version
  allow_major_version_upgrade  = true                           # CRITICAL: needed for major upgrades
  apply_immediately            = true                           # CRITICAL: apply now to pass the check
}

# CloudFormation: upgrade RDS engine version for an existing instance
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceIdentifier: <example_resource_id>
      Engine: <engine>
      DBInstanceClass: db.t3.micro
      EngineVersion: <SUPPORTED_ENGINE_VERSION>  # CRITICAL: move to a supported engine version
      AllowMajorVersionUpgrade: true             # CRITICAL: required if upgrading major version
      ApplyImmediately: true                     # CRITICAL: apply change now to pass the check

References

https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-engine-versions.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_instance_deprecated_engine_version. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

RDS instance has deletion protection enabled RDS instance has enhanced monitoring enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires