Back to Checks
aws

RDS instance is not enrolled in RDS Extended Support

rds_instance_extended_support
Service: rdsSeverity: medium
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:AwsRdsDbInstance

RDS DB instances are evaluated for enrollment in Amazon RDS Extended Support. The check fails if EngineLifecycleSupportis set to open-source-rds-extended-support, indicating the instance will incur additional charges after standard support ends.

Prowler logoProwlerprowler-provider-aws

Risk

DB instances enrolled in RDS Extended Support can incur additional charges after the end of standard support for the running database major version. Remaining on older major versions can also delay necessary upgrades, increasing operational and security risk.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks rds_instance_extended_support

Recommendation

Upgrade enrolled DB instances to an engine version covered under standard support to stop Extended Support charges. For new DB instances and restores created via automation, explicitly set the engine lifecycle support option to avoid unintended enrollment in RDS Extended Support when that is your policy.

Remediation

CLI

aws rds modify-db-instance --db-instance-identifier <DB_INSTANCE_IDENTIFIER> --engine-version <TARGET_ENGINE_VERSION> --allow-major-version-upgrade --apply-immediately
# For new DB instances created via automation, prevent enrollment by setting the lifecycle option:
aws rds create-db-instance ... --engine-lifecycle-support open-source-rds-extended-support-disabled

Terraform

# Upgrade RDS engine version
resource "aws_db_instance" "<example_resource_name>" {
  identifier         = "<example_resource_id>"
  engine             = "<engine>"
  instance_class     = "db.t3.micro"
  allocated_storage  = 20

  engine_version               = "<SUPPORTED_ENGINE_VERSION>"  # CRITICAL: use a supported version
  allow_major_version_upgrade  = true                           # CRITICAL: needed for major upgrades
  apply_immediately            = true                           # CRITICAL: apply now to pass the check
}

NativeIaC

# CloudFormation: upgrade RDS engine version for an existing instance
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceIdentifier: <example_resource_id>
      Engine: <engine>
      DBInstanceClass: db.t3.micro
      EngineVersion: <SUPPORTED_ENGINE_VERSION>  # CRITICAL: move to a supported engine version
      AllowMajorVersionUpgrade: true             # CRITICAL: required if upgrading major version
      ApplyImmediately: true                     # CRITICAL: apply change now to pass the check

Other

1If your automation (CloudFormation/Terraform/SDK) creates or restores DB instances, set EngineLifecycleSupport/LifeCycleSupport to open-source-rds-extended-support-disabled where supported, and ensure your upgrade process keeps engines within standard support.

Check Code

"""
Prowler check: rds_instance_extended_support

This check fails when an RDS DB instance is enrolled in Amazon RDS Extended Support.
Enrollment is exposed via the "EngineLifecycleSupport" attribute returned by DescribeDBInstances.
"""

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.rds.rds_client import rds_client


class rds_instance_extended_support(Check):
    def execute(self):
        findings = []

        for db_instance in rds_client.db_instances.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=db_instance)

            # EngineLifecycleSupport can be absent when Extended Support is not applicable.
            lifecycle_support = getattr(db_instance, "engine_lifecycle_support", None)

            if lifecycle_support == "open-source-rds-extended-support":
                report.status = "FAIL"
                report.status_extended = (
                    f"RDS instance {db_instance.id} ({db_instance.engine} {db_instance.engine_version}) "
                    f"is enrolled in RDS Extended Support (EngineLifecycleSupport={lifecycle_support})."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"RDS instance {db_instance.id} ({db_instance.engine} {db_instance.engine_version}) "
                    "is not enrolled in RDS Extended Support."
                )

            findings.append(report)

        return findings

References