Back to Checks
aws

Amazon MQ broker has automated minor version upgrades enabled

mq_broker_auto_minor_version_upgrades
Service: mqSeverity: low
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:AwsAmazonMQBroker

Amazon MQ brokers have autoMinorVersionUpgrade enabled to automatically apply supported minor and patch engine updates during the scheduled maintenance window.

Prowler logoProwlerprowler-provider-aws

Risk

Without automatic minor upgrades, brokers may run known-vulnerable engine versions, enabling exploits that impact:

  • Confidentiality: message disclosure
  • Integrity: tampering or replay
  • Availability: crashes/DoS and instability

Delayed patches also increase operational risk and drift.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks mq_broker_auto_minor_version_upgrades

Recommendation

Enable autoMinorVersionUpgrade on all brokers to reduce patch latency.

  • Align upgrades with a defined maintenance window
  • Validate changes in staging before production
  • Monitor broker health and logs after updates
  • Maintain HA and tested backups for rollback (defense in depth)

Remediation

CLI

aws mq update-broker --broker-id <example_resource_id> --auto-minor-version-upgrade

Terraform

# Terraform: Enable automatic minor version upgrades on an MQ broker
resource "aws_mq_broker" "<example_resource_name>" {
  broker_name                = "<example_resource_name>"
  engine_type                = "ActiveMQ"
  engine_version             = "<ENGINE_VERSION>"
  host_instance_type         = "mq.t3.micro"
  publicly_accessible        = true
  auto_minor_version_upgrade = true  # Critical: enables automatic minor version upgrades

  user {
    username = "<USERNAME>"
    password = "<PASSWORD>"
  }
}

NativeIaC

# CloudFormation: Enable automatic minor version upgrades on an MQ broker
Resources:
  <example_resource_name>:
    Type: AWS::AmazonMQ::Broker
    Properties:
      BrokerName: <example_resource_name>
      AutoMinorVersionUpgrade: true  # Critical: enables automatic minor version upgrades
      DeploymentMode: SINGLE_INSTANCE
      EngineType: ACTIVEMQ
      EngineVersion: <ENGINE_VERSION>
      HostInstanceType: mq.t3.micro
      PubliclyAccessible: true
      Users:
        - Username: <USERNAME>
          Password: <PASSWORD>

Other

1Open the Amazon MQ console
2Go to Brokers and select the target broker
3Click Edit
4Under Maintenance, check Enable automatic minor version upgrades
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.mq.mq_client import mq_client


class mq_broker_auto_minor_version_upgrades(Check):
    def execute(self):
        findings = []
        for broker in mq_client.brokers.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=broker)
            report.status = "PASS"
            report.status_extended = f"MQ Broker {broker.name} does have automated minor version upgrades enabled."

            if not broker.auto_minor_version_upgrade:
                report.status = "FAIL"
                report.status_extended = f"MQ Broker {broker.name} does not have automated minor version upgrades enabled."

            findings.append(report)

        return findings

References