Check ID: rds_instance_extended_support
Provider: AWS
Service: rds
Severity: MEDIUM
Categories: vulnerabilities
Resource type: AwsRdsDbInstance

What this check verifies

RDS DB instances are evaluated for enrollment in Amazon RDS Extended Support. The check fails if EngineLifecycleSupportis set to open-source-rds-extended-support, indicating the instance will incur additional charges after standard support ends.

Risk

DB instances enrolled in RDS Extended Support can incur additional charges after the end of standard support for the running database major version. Remaining on older major versions can also delay necessary upgrades, increasing operational and security risk.

Recommendation

Upgrade enrolled DB instances to an engine version covered under standard support to stop Extended Support charges. For new DB instances and restores created via automation, explicitly set the engine lifecycle support option to avoid unintended enrollment in RDS Extended Support when that is your policy.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws rds modify-db-instance —db-instance-identifier <DB_INSTANCE_IDENTIFIER> —engine-version <TARGET_ENGINE_VERSION> —allow-major-version-upgrade —apply-immediately

For new DB instances created via automation, prevent enrollment by setting the lifecycle option:

aws rds create-db-instance … —engine-lifecycle-support open-source-rds-extended-support-disabled

# Upgrade RDS engine version
resource "aws_db_instance" "<example_resource_name>" {
  identifier         = "<example_resource_id>"
  engine             = "<engine>"
  instance_class     = "db.t3.micro"
  allocated_storage  = 20

  engine_version               = "<SUPPORTED_ENGINE_VERSION>"  # CRITICAL: use a supported version
  allow_major_version_upgrade  = true                           # CRITICAL: needed for major upgrades
  apply_immediately            = true                           # CRITICAL: apply now to pass the check
}

# CloudFormation: upgrade RDS engine version for an existing instance
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceIdentifier: <example_resource_id>
      Engine: <engine>
      DBInstanceClass: db.t3.micro
      EngineVersion: <SUPPORTED_ENGINE_VERSION>  # CRITICAL: move to a supported engine version
      AllowMajorVersionUpgrade: true             # CRITICAL: required if upgrading major version
      ApplyImmediately: true                     # CRITICAL: apply change now to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_instance_extended_support. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

RDS DB security group event subscription is enabled RDS instance has IAM database authentication enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​For new DB instances created via automation, prevent enrollment by setting the lifecycle option:

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

For new DB instances created via automation, prevent enrollment by setting the lifecycle option:

References

Where this check fires