Back to Checks
aws

RDS cluster has automatic minor version upgrades enabled

rds_cluster_minor_version_upgrade_enabled
Service: rdsSeverity: medium
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:AwsRdsDbCluster

RDS Multi-AZ DB clusters are configured for automatic minor engine upgrades via auto_minor_version_upgrade.

The evaluation checks these clusters to see if this setting is enabled so preferred minor releases are applied during the maintenance window.

Prowler logoProwlerprowler-provider-aws

Risk

Without automatic minor upgrades, clusters can miss security patches, enabling exploitation of known flaws (confidentiality). Unfixed defects may corrupt data (integrity) or trigger crashes and failovers (availability). Emergency patching raises downtime and operational risk.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks rds_cluster_minor_version_upgrade_enabled

Recommendation

Enable auto_minor_version_upgrade on RDS Multi-AZ clusters and align updates with approved maintenance windows. Validate changes in non-production, and document any exceptions with a strict manual patch cadence. This strengthens defense in depth and improves availability.

Remediation

CLI

aws rds modify-db-cluster --db-cluster-identifier <example_resource_id> --auto-minor-version-upgrade

Terraform

# Terraform snippet to enable automatic minor version upgrades on an RDS DB cluster
resource "aws_rds_cluster" "<example_resource_name>" {
  cluster_identifier         = "<example_resource_id>"
  auto_minor_version_upgrade = true  # Critical: enables automatic minor engine version upgrades to pass the check
}

NativeIaC

# CloudFormation snippet to enable automatic minor version upgrades on an RDS DB cluster
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBCluster
    Properties:
      AutoMinorVersionUpgrade: true  # Critical: enables automatic minor engine version upgrades to pass the check

Other

1In the AWS Console, go to RDS > Databases
2Select your Multi-AZ DB cluster
3Click Modify
4Set Auto minor version upgrade to Enabled
5Click Continue, then Modify cluster

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.rds.rds_client import rds_client


class rds_cluster_minor_version_upgrade_enabled(Check):
    def execute(self):
        findings = []
        for db_cluster in rds_client.db_clusters:
            # Auto minor version upgrade is only available for non-Aurora Multi-AZ DB clusters
            if rds_client.db_clusters[db_cluster].multi_az:
                report = Check_Report_AWS(
                    metadata=self.metadata(),
                    resource=rds_client.db_clusters[db_cluster],
                )
                if rds_client.db_clusters[db_cluster].auto_minor_version_upgrade:
                    report.status = "PASS"
                    report.status_extended = f"RDS Cluster {rds_client.db_clusters[db_cluster].id} has minor version upgrade enabled."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"RDS Cluster {rds_client.db_clusters[db_cluster].id} does not have minor version upgrade enabled."

                findings.append(report)

        return findings

References