Back to Checks
aws

RDS instance has minor version upgrade enabled

rds_instance_minor_version_upgrade_enabled
Service: rdsSeverity: medium
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:AwsRdsDbInstance

RDS DB instances are evaluated for the auto_minor_version_upgrade setting that enables automatic minor engine updates during maintenance windows.

Prowler logoProwlerprowler-provider-aws

Risk

Without automatic minor upgrades, databases miss security patches, leaving known vulnerabilities exploitable and risking unauthorized data access. Unapplied fixes can cause data corruption and outages, harming integrity and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks rds_instance_minor_version_upgrade_enabled

Recommendation

Enable auto_minor_version_upgrade on RDS instances so minor releases are applied promptly. Use maintenance windows and stage testing to limit impact. Follow defense in depth and least privilege; keep reliable backups and Multi-AZ to preserve continuity if upgrades require rollback.

Remediation

CLI

aws rds modify-db-instance --db-instance-identifier <db_instance_id> --auto-minor-version-upgrade --apply-immediately

Terraform

# Enable auto minor version upgrades on an RDS instance
resource "aws_db_instance" "<example_resource_name>" {
  allocated_storage          = 20
  engine                     = "mysql"
  instance_class             = "db.t3.micro"
  username                   = "<username>"
  password                   = "<password>"
  auto_minor_version_upgrade = true  # Critical: turns on automatic minor engine upgrades
}

NativeIaC

# CloudFormation: Enable auto minor version upgrades on an RDS instance
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceIdentifier: <example_resource_id>
      DBInstanceClass: db.t3.micro
      Engine: mysql
      MasterUsername: <username>
      MasterUserPassword: <password>
      AllocatedStorage: '20'
      AutoMinorVersionUpgrade: true  # Critical: ensures RDS applies minor engine updates automatically

Other

1In the AWS Console, go to RDS > Databases
2Select the DB instance and click Modify
3Find "Auto minor version upgrade" and set it to Enable
4Click Continue, check Apply immediately, then click Modify DB instance

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.rds.rds_client import rds_client


class rds_instance_minor_version_upgrade_enabled(Check):
    def execute(self):
        findings = []
        for db_instance in rds_client.db_instances.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=db_instance)
            if db_instance.auto_minor_version_upgrade:
                report.status = "PASS"
                report.status_extended = (
                    f"RDS Instance {db_instance.id} has minor version upgrade enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = f"RDS Instance {db_instance.id} does not have minor version upgrade enabled."

            findings.append(report)

        return findings

References