ElastiCache Redis cache cluster has automatic minor version upgrades enabled

elasticache_redis_cluster_auto_minor_version_upgrades

Service: elasticacheSeverity: high

OfficialBuilt-inVerified

Resource Type:Other

ElastiCache for Redis replication groups are configured to apply automatic minor engine upgrades using AutoMinorVersionUpgrade

Prowler prowler-provider-aws

Risk

Without automatic minor upgrades, Redis nodes may run versions with known CVEs and stability bugs, enabling unauthorized access, replication inconsistencies, or crashes. Delayed patching widens the attack window and lengthens maintenance, degrading confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud

Run

prowler aws --checks elasticache_redis_cluster_auto_minor_version_upgrades

Recommendation

Enable AutoMinorVersionUpgrade for Redis replication groups and govern updates with a maintenance window. Apply patch management and defense in depth: validate in staging, keep recent backups, use Multi-AZ for resilience, and monitor release notes to ensure timely, low-impact updates.

Remediation

CLI

aws elasticache modify-replication-group --replication-group-id <replication_group_id> --auto-minor-version-upgrade --apply-immediately

Terraform

# Enable auto minor version upgrades on an ElastiCache replication group
resource "aws_elasticache_replication_group" "<example_resource_name>" {
  replication_group_id       = "<example_resource_id>"
  description                = "<example_description>"
  node_type                  = "<example_node_type>"
  num_cache_clusters         = 1
  auto_minor_version_upgrade = true  # CRITICAL: automatically applies minor engine upgrades
}

NativeIaC

# CloudFormation: enable auto minor version upgrades on a Replication Group
Resources:
  <example_resource_name>:
    Type: AWS::ElastiCache::ReplicationGroup
    Properties:
      ReplicationGroupDescription: "<example_description>"
      CacheNodeType: "<example_node_type>"
      NumCacheClusters: 1
      AutoMinorVersionUpgrade: true  # CRITICAL: turns on automatic minor version upgrades
      # This ensures new minor engine versions are applied automatically

Other

1Open the AWS console and go to ElastiCache

2Select Replication groups, choose the target group

3Click Modify

4Enable Automatic minor version upgrade

5Check Apply immediately and click Modify to save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elasticache.elasticache_client import (
    elasticache_client,
)


class elasticache_redis_cluster_auto_minor_version_upgrades(Check):
    def execute(self):
        findings = []
        for repl_group in elasticache_client.replication_groups.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=repl_group)
            report.status = "PASS"
            report.status_extended = f"Elasticache Redis cache cluster {repl_group.id} does have automated minor version upgrades enabled."

            if not repl_group.auto_minor_version_upgrade:
                report.status = "FAIL"
                report.status_extended = f"Elasticache Redis cache cluster {repl_group.id} does not have automated minor version upgrades enabled."

            findings.append(report)

        return findings