Back to Checks
aws

RDS instance uses a supported engine version

rds_instance_deprecated_engine_version
Service: rdsSeverity: high
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:AwsRdsDbInstance

RDS DB instances use a supported, non-deprecated engine version for MariaDB, MySQL, or PostgreSQL. The instance's engine and engine_version are evaluated against versions currently supported in the region.

Prowler logoProwlerprowler-provider-aws

Risk

Deprecated engine versions lack security fixes and support, enabling exploitation of known flaws impacting confidentiality and integrity. Availability can suffer from forced maintenance or failed upgrades.

  • Unpatched CVEs
  • TLS/client incompatibilities
  • Replication or backup/restore issues

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks rds_instance_deprecated_engine_version

Recommendation

Standardize on supported engine versions and keep them current.

  • Plan and test upgrades; back up and define rollback
  • Enable AutoMinorVersionUpgrade where acceptable
  • Monitor deprecation notices and upgrade before EoS
  • Enforce least privilege to limit blast radius during incidents

Remediation

CLI

aws rds modify-db-instance --db-instance-identifier <DB_INSTANCE_ID> --engine-version <SUPPORTED_ENGINE_VERSION> --allow-major-version-upgrade --apply-immediately

Terraform

# Upgrade RDS engine version
resource "aws_db_instance" "<example_resource_name>" {
  identifier         = "<example_resource_id>"
  engine             = "<engine>"
  instance_class     = "db.t3.micro"
  allocated_storage  = 20

  engine_version               = "<SUPPORTED_ENGINE_VERSION>"  # CRITICAL: use a supported version
  allow_major_version_upgrade  = true                           # CRITICAL: needed for major upgrades
  apply_immediately            = true                           # CRITICAL: apply now to pass the check
}

NativeIaC

# CloudFormation: upgrade RDS engine version for an existing instance
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceIdentifier: <example_resource_id>
      Engine: <engine>
      DBInstanceClass: db.t3.micro
      EngineVersion: <SUPPORTED_ENGINE_VERSION>  # CRITICAL: move to a supported engine version
      AllowMajorVersionUpgrade: true             # CRITICAL: required if upgrading major version
      ApplyImmediately: true                     # CRITICAL: apply change now to pass the check

Other

1In the AWS Console, go to RDS > Databases
2Select the DB instance
3Click Modify
4Under DB engine version, select a supported version
5If moving to a new major version, check Allow major version upgrade
6Check Apply immediately
7Click Continue, then Modify DB instance

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.rds.rds_client import rds_client


class rds_instance_deprecated_engine_version(Check):
    def execute(self):
        findings = []
        for db_instance in rds_client.db_instances.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=db_instance)
            report.status = "FAIL"
            report.status_extended = f"RDS instance {db_instance.id} is using a deprecated engine {db_instance.engine} with version {db_instance.engine_version}."
            if (
                hasattr(
                    rds_client.db_engines.get(db_instance.region, {}).get(
                        db_instance.engine, {}
                    ),
                    "engine_versions",
                )
                and db_instance.engine_version
                in rds_client.db_engines[db_instance.region][
                    db_instance.engine
                ].engine_versions
            ):
                report.status = "PASS"
                report.status_extended = f"RDS instance {db_instance.id} is not using a deprecated engine {db_instance.engine} with version {db_instance.engine_version}."

            findings.append(report)

        return findings

References