Back to Checks
aws

MemoryDB cluster has automatic minor version upgrades enabled

memorydb_cluster_auto_minor_version_upgrades
Service: memorydbSeverity: medium
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:Other

MemoryDB clusters are evaluated for the auto_minor_version_upgrade setting that automatically applies new minor engine versions.

Prowler logoProwlerprowler-provider-aws

Risk

Without automatic minor upgrades, clusters may run known-vulnerable engine versions.

  • Exploitable CVEs enable unauthorized reads/writes (confidentiality, integrity)
  • Unpatched bugs can cause DoS or data loss (availability)
  • Version drift raises operational risk and slows incident response

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks memorydb_cluster_auto_minor_version_upgrades

Recommendation

Enable automatic minor version upgrades (auto_minor_version_upgrade=true) for all clusters. Schedule updates in a maintenance window, validate in staging, and keep rollback plans. Apply defense in depth with strict ACLs and monitoring to limit exposure between releases.

Remediation

CLI

aws memorydb update-cluster --cluster-name <cluster-name> --auto-minor-version-upgrade

Terraform

resource "aws_memorydb_cluster" "<example_resource_name>" {
  name       = "<example_resource_name>"
  acl_name   = "<example_acl_name>"
  node_type  = "<example_node_type>"
  num_shards = 1

  auto_minor_version_upgrade = true  # Critical: enables automatic minor version upgrades
}

NativeIaC

# Enable automatic minor version upgrades for a MemoryDB cluster
Resources:
  <example_resource_name>:
    Type: AWS::MemoryDB::Cluster
    Properties:
      ClusterName: <example_resource_name>
      ACLName: <example_acl_name>
      NodeType: <example_node_type>
      NumShards: 1
      AutoMinorVersionUpgrade: true  # Critical: enables automatic minor version upgrades

Other

1In the AWS Console, go to MemoryDB > Clusters
2Select the cluster <cluster-name> and click Edit
3Enable "Auto minor version upgrade"
4Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.memorydb.memorydb_client import memorydb_client


class memorydb_cluster_auto_minor_version_upgrades(Check):
    def execute(self):
        findings = []
        for cluster in memorydb_client.clusters.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            if cluster.auto_minor_version_upgrade:
                report.status = "PASS"
                report.status_extended = f"Memory DB Cluster {cluster.name} has minor version upgrade enabled."
            else:
                report.status = "FAIL"
                report.status_extended = f"Memory DB Cluster {cluster.name} does not have minor version upgrade enabled."

            findings.append(report)

        return findings

References