Skip to main content

📝 AWS DMS Replication Instance Auto Minor Version Upgrade is not enabled 🟢

  • Contextual name: 📝 Replication Instance Auto Minor Version Upgrade is not enabled 🟢
  • ID: /ce/ca/aws/dms/replication-instance-auto-minor-upgrade
  • Located in: 📁 AWS DMS

Flags​

Our Metadata​

  • Policy Type: COMPLIANCE_POLICY
  • Policy Category:
    • SECURITY

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-0d66ed991

Logic​

Description​

Open File

Description​

Ensure that all AWS Database Migration Service (DMS) Replication Instances have the Auto Minor Version Upgrade feature enabled.

Rationale​

Enabling auto minor version upgrades ensures that your DMS replication instances automatically receive the latest minor engine updates from AWS. These upgrades can include security patches, bug fixes, and performance improvements without requiring manual intervention.

Impact​

Updates are deployed during the instance’s defined maintenance window, which may incur a brief service interruption. Schedule this setting during periods of low traffic to minimize impact on ongoing migrations.

Audit​

This policy marks an AWS DMS Replication Instance as INCOMPLIANT if the Minor Version Automatic Update checkbox is set to false.

Remediation​

Open File

Remediation​

To enable automatic minor version upgrades for existing DMS replication instances, use one of the following approaches:

Using AWS CloudFormation​

  • CloudFormation template (YAML):
AWSTemplateFormatVersion: '2010-09-09'
Description: Enable Auto Minor Version Upgrade on an existing DMS replication instance

Parameters:
  ReplicationInstanceIdentifier:
    Type: String
    Description: ARN of the existing DMS replication instance
  ReplicationInstanceClass:
    Type: String
    Description: DMS instance class (e.g., dms.c4.large)

Resources:
  AutoMinorUpgradeDMS:
    Type: AWS::DMS::ReplicationInstance
    Properties:
      ReplicationInstanceIdentifier: !Ref ReplicationInstanceIdentifier
      ReplicationInstanceClass: !Ref ReplicationInstanceClass
      AutoMinorVersionUpgrade: true

Note: Ensure that the ReplicationInstanceArn parameter matches the target instance’s ARN.

From Command Line​

Run the following command to modify the replication instance:

aws dms modify-replication-instance \
    --replication-instance-arn {{replication-instance-arn}} \

... [see more](remediation.md)

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 APRA CPG 234 → 💼 16c information security operations and administration;33
💼 APRA CPG 234 → 💼 36h patch management controls — to manage the assessment and application of patches and other updates that address known vulnerabilities in a timely manner;66
💼 APRA CPG 234 → 💼 40 An important aspect of information asset life-cycle management involves minimising vulnerabilities and maintaining support. Information security exposures could arise from hardware and software which is outdated or has limited or no support (whether through a third party, a related party or in-house). Technology that is end-of-life5 , out-of-support or in extended support is typically less secure by design, has a dated security model and can take longer, or is unable, to be updated to address new threats.66
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [DMS.6] DMS replication instances should have automatic minor version upgrade enabled11
💼 Cloudaware Framework → 💼 Infrastructure Modernization11
💼 FedRAMP High Security Controls → 💼 SI-2 Flaw Remediation (L)(M)(H)2710
💼 FedRAMP High Security Controls → 💼 SI-2(2) Automated Flaw Remediation Status (M)(H)2
💼 FedRAMP Low Security Controls → 💼 SI-2 Flaw Remediation (L)(M)(H)10
💼 FedRAMP Moderate Security Controls → 💼 SI-2 Flaw Remediation (L)(M)(H)210
💼 FedRAMP Moderate Security Controls → 💼 SI-2(2) Automated Flaw Remediation Status (M)(H)2
💼 ISO/IEC 27001:2013 → 💼 A.12.5.1 Installation of software on operational systems55
💼 NIST CSF v1.1 → 💼 DE.CM-5: Unauthorized mobile code is detected1212
💼 NIST CSF v1.1 → 💼 ID.AM-2: Software platforms and applications within the organization are inventoried57
💼 NIST CSF v1.1 → 💼 ID.RA-1: Asset vulnerabilities are identified and documented1416
💼 NIST CSF v1.1 → 💼 PR.DS-6: Integrity checking mechanisms are used to verify software, firmware, and information integrity2226
💼 NIST CSF v1.1 → 💼 PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality)326
💼 NIST CSF v1.1 → 💼 PR.IP-3: Configuration change control processes are in place55
💼 NIST CSF v1.1 → 💼 PR.IP-12: A vulnerability management plan is developed and implemented79
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events114
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events133
💼 NIST CSF v2.0 → 💼 ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained9
💼 NIST CSF v2.0 → 💼 ID.IM-01: Improvements are identified from evaluations20
💼 NIST CSF v2.0 → 💼 ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties33
💼 NIST CSF v2.0 → 💼 ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities34
💼 NIST CSF v2.0 → 💼 ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded26
💼 NIST CSF v2.0 → 💼 ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked28
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected110
💼 NIST SP 800-53 Revision 4 → 💼 SI-2 FLAW REMEDIATION622
💼 NIST SP 800-53 Revision 5 → 💼 SI-2 Flaw Remediation667
💼 NIST SP 800-53 Revision 5 → 💼 SI-2(2) Flaw Remediation _ Automated Flaw Remediation Status12
💼 NIST SP 800-53 Revision 5 → 💼 SI-2(4) Flaw Remediation _ Automated Patch Management Tools2
💼 NIST SP 800-53 Revision 5 → 💼 SI-2(5) Flaw Remediation _ Automatic Software and Firmware Updates22
💼 NIST SP 800-53 Revision 5 → 💼 SI-2(6) Flaw Remediation _ Removal of Previous Versions of Software and Firmware66
💼 NIST SP 800-53 Revision 5 → 💼 SI-7(12) Software, Firmware, and Information Integrity _ Integrity Verification1921
💼 PCI DSS v3.2.1 → 💼 6.2 Ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor-supplied security patches.2
💼 PCI DSS v4.0.1 → 💼 6.3.3 All system components are protected from known vulnerabilities by installing applicable security patches/updates2
💼 PCI DSS v4.0 → 💼 6.3.3 All system components are protected from known vulnerabilities by installing applicable security patches/updates2
💼 UK Cyber Essentials → 💼 3.1 All software on in-scope devices must be licensed and supported66
💼 UK Cyber Essentials → 💼 3.3 All software on in-scope devices must have automatic updates enabled where possible22