Skip to main content

⭐ Repository β†’ πŸ“ Compliance Engine β†’ πŸ“ CloudAware β†’ πŸ“ AWS β†’ πŸ“ ElastiCache

πŸ›‘οΈ AWS ElastiCache Redis Cluster Auto Minor Version Upgrade is not enabled🟒

  • Contextual name: πŸ›‘οΈ Redis Cluster Auto Minor Version Upgrade is not enabled🟒
  • ID: /ce/ca/aws/elasticache/redis-cluster-auto-minor-version-upgrade
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: RELIABILITY

Logic​

Description​

Open File

Description​

This policy identifies AWS ElastiCache for Redis clusters where the Auto Minor Version Upgrade feature is not enabled.

When enabled, this setting ensures that clusters automatically apply minor engine upgrades, which may include new features, performance enhancements, bug fixes, and security patches released by AWS.

Rationale​

Enabling auto minor version upgrades reduces manual operational effort and helps ensure that ElastiCache clusters remain secure, stable, and performant. It also minimizes the risk of exposure to known vulnerabilities and software defects.

Impact​

If auto minor version upgrades are not enabled, clusters may continue running outdated software versions. This increases the risk of security vulnerabilities, performance degradation, and compatibility issues.

Enabling this feature may require a scheduled maintenance window. During the upgrade, the cluster can experience a brief service interruption. For multi-node clusters, ElastiCache performs rolling upgrades to minimize downtime.

Audit​

... see more

Remediation​

Open File

Remediation​

Enable Auto Minor Version Upgrade​

From Command Line​
aws elasticache modify-cache-cluster \
    --cache-cluster-id {{cluster-id}} \
    --auto-minor-version-upgrade

The --apply-immediately flag applies the change immediately; omit it to apply during the next maintenance window.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [ElastiCache.2] ElastiCache clusters should have automatic minor version upgrades enabled1no data
πŸ’Ό AWS Well-Architected β†’ πŸ’Ό OPS05-BP05 Perform patch management2no data
πŸ’Ό Cloudaware Framework β†’ πŸ’Ό Infrastructure Modernization14no data
πŸ’Ό FedRAMP High Security Controls β†’ πŸ’Ό SI-2 Flaw Remediation (L)(M)(H)2712no data
πŸ’Ό FedRAMP High Security Controls β†’ πŸ’Ό SI-2(2) Automated Flaw Remediation Status (M)(H)3no data
πŸ’Ό FedRAMP Low Security Controls β†’ πŸ’Ό SI-2 Flaw Remediation (L)(M)(H)12no data
πŸ’Ό FedRAMP Moderate Security Controls β†’ πŸ’Ό SI-2 Flaw Remediation (L)(M)(H)212no data
πŸ’Ό FedRAMP Moderate Security Controls β†’ πŸ’Ό SI-2(2) Automated Flaw Remediation Status (M)(H)3no data
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό ID.IM-01: Improvements are identified from evaluations24no data
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties37no data
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities38no data
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό SI-2 Flaw Remediation669no data
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό SI-2(2) Flaw Remediation _ Automated Flaw Remediation Status13no data
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό SI-2(4) Flaw Remediation _ Automated Patch Management Tools3no data
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό SI-2(5) Flaw Remediation _ Automatic Software and Firmware Updates23no data
πŸ’Ό PCI DSS v3.2.1 β†’ πŸ’Ό 6.2 Ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor-supplied security patches.3no data
πŸ’Ό PCI DSS v4.0.1 β†’ πŸ’Ό 6.3.3 All system components are protected from known vulnerabilities by installing applicable security patches/updates3no data
πŸ’Ό PCI DSS v4.0 β†’ πŸ’Ό 6.3.3 All system components are protected from known vulnerabilities by installing applicable security patches/updates3no data