RDS instance has minor version upgrade enabled

Check ID: rds_instance_minor_version_upgrade_enabled
Provider: AWS
Service: rds
Severity: MEDIUM
Categories: vulnerabilities
Resource type: AwsRdsDbInstance

What this check verifies

RDS DB instances are evaluated for the auto_minor_version_upgrade setting that enables automatic minor engine updates during maintenance windows.

Risk

Without automatic minor upgrades, databases miss security patches, leaving known vulnerabilities exploitable and risking unauthorized data access. Unapplied fixes can cause data corruption and outages, harming integrity and availability.

Recommendation

Enable auto_minor_version_upgrade on RDS instances so minor releases are applied promptly. Use maintenance windows and stage testing to limit impact. Follow defense in depth and least privilege; keep reliable backups and Multi-AZ to preserve continuity if upgrades require rollback.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws rds modify-db-instance —db-instance-identifier <db_instance_id> —auto-minor-version-upgrade —apply-immediately

# Enable auto minor version upgrades on an RDS instance
resource "aws_db_instance" "<example_resource_name>" {
  allocated_storage          = 20
  engine                     = "mysql"
  instance_class             = "db.t3.micro"
  username                   = "<username>"
  password                   = "<password>"
  auto_minor_version_upgrade = true  # Critical: turns on automatic minor engine upgrades
}

# CloudFormation: Enable auto minor version upgrades on an RDS instance
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceIdentifier: <example_resource_id>
      DBInstanceClass: db.t3.micro
      Engine: mysql
      MasterUsername: <username>
      MasterUserPassword: <password>
      AllocatedStorage: '20'
      AutoMinorVersionUpgrade: true  # Critical: ensures RDS applies minor engine updates automatically

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_instance_minor_version_upgrade_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

RDS instance exports logs to CloudWatch Logs RDS instance has Multi-AZ enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires