Back to Checks
aws

DMS replication instance has auto minor version upgrade enabled

dms_instance_minor_version_upgrade_enabled
Service: dmsSeverity: medium
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:AwsDmsReplicationInstance

AWS DMS replication instances are evaluated for the auto_minor_version_upgrade setting to confirm automatic minor engine updates are enabled during the maintenance window.

Prowler logoProwlerprowler-provider-aws

Risk

Without automatic minor upgrades, DMS engines can miss security patches and fixes, enabling exploitation of known flaws and instability.

  • Confidentiality: exposure via unpatched components
  • Integrity: replication errors or data drift
  • Availability: outages during migration or CDC

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks dms_instance_minor_version_upgrade_enabled

Recommendation

Enable auto_minor_version_upgrade on all replication instances to maintain continuous patching.

  • Set a maintenance window and validate in non-prod
  • Monitor release notes and health metrics
  • Enforce least privilege for change control
  • Keep backups for rollback

Remediation

CLI

aws dms modify-replication-instance --region <REGION> --replication-instance-arn arn:aws:dms:<REGION>:<ACCOUNT_ID>:rep:<REPLICATION_ID> --auto-minor-version-upgrade --apply-immediately

Terraform

# Terraform: Enable auto minor version upgrade on a DMS replication instance
resource "aws_dms_replication_instance" "<example_resource_name>" {
  replication_instance_id    = "<example_resource_id>"
  replication_instance_class = "dms.t3.micro"
  auto_minor_version_upgrade = true  # CRITICAL: turns on automatic minor version upgrades
}

NativeIaC

# CloudFormation: Enable auto minor version upgrade on a DMS replication instance
Resources:
  <example_resource_name>:
    Type: AWS::DMS::ReplicationInstance
    Properties:
      ReplicationInstanceIdentifier: <example_resource_id>
      ReplicationInstanceClass: dms.t3.micro
      AutoMinorVersionUpgrade: true  # CRITICAL: turns on automatic minor version upgrades

Other

1Open the AWS Console and go to Database Migration Service (DMS)
2Click Replication instances and select your instance
3Choose Actions > Modify
4Check Auto minor version upgrade
5Select Apply immediately
6Click Modify to save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.dms.dms_client import dms_client


class dms_instance_minor_version_upgrade_enabled(Check):
    def execute(self):
        findings = []
        for instance in dms_client.instances:
            report = Check_Report_AWS(metadata=self.metadata(), resource=instance)
            report.status = "FAIL"
            report.status_extended = f"DMS Replication Instance {instance.id} does not have auto minor version upgrade enabled."
            if instance.auto_minor_version_upgrade:
                report.status = "PASS"
                report.status_extended = f"DMS Replication Instance {instance.id} has auto minor version upgrade enabled."

            findings.append(report)

        return findings

References