Skip to main content

🛡️ AWS RDS Instance Auto Minor Version Upgrade is not enabled🟠🟢

Logic​

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-215302da1

Internal Notes 🟠​

Open File

Notes​

  • For some reason, similar policies mention only mysql and postgres engines in the policy audit and remediation sections. However, AWS documentation tells that AutoMinorVersionUpgrade attribute is supported on ALL DB engines: docs

  • We've modified the ssh commands to include all engines (see remediation.md).

  • Our policy document also accepts all engines (doesn't filter any).

Description​

Open File

Description​

Ensure that RDS database instances have the Auto Minor Version Upgrade flag enabled to receive minor engine upgrades automatically during the specified maintenance window. This allows RDS instances to get new features, bug fixes, and security patches for their database engines.

Rationale​

AWS RDS will occasionally deprecate minor engine versions and provide new ones for an upgrade. When the last version number within the release is replaced, the version change is considered minor. With the Auto Minor Version Upgrade feature enabled, upgrades occur automatically during the specified maintenance window so your RDS instances can get new features, bug fixes, and security patches for their database engines.

Audit​

From Console​
  1. Log in to the AWS Management Console and navigate to the RDS dashboard at https://console.aws.amazon.com/rds/.
  2. In the left navigation panel, click on Databases.
  3. Select the RDS instance that you want to examine.
  4. Click on the Maintenance and backups panel.
  5. Under the Maintenance section, search for the Auto Minor Version Upgrade status.

... see more

Remediation​

Open File

Remediation​

Enable Auto Minor Version Upgrade​

Using AWS CloudFormation​
  • CloudFormation template (YAML):
AWSTemplateFormatVersion: '2010-09-09'
Description: Enables automatic minor version upgrades for an existing RDS instance.

Parameters:
  DBInstanceIdentifier:
    Type: String
    Description: ID of the existing RDS instance

Resources:
  AutoMinorUpgradeRDS:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceIdentifier: !Ref DBInstanceIdentifier
      AutoMinorVersionUpgrade: true
Using Terraform​
  • Terraform configuration file (.tf):
terraform {
 required_providers {
  aws = {
   source  = "hashicorp/aws"
   version = "~> 3.27"
  }
 }

 required_version = ">= 0.14.9"
}

provider "aws" {
 profile = "default"
 region  = "us-east-1"
}

resource "aws_db_instance" "rds-database-instance" {
 allocated_storage     = 20
 engine                = "mysql"
 engine_version        = "5.7"
 instance_class        = "db.t2.small"
 name                  = "mysqldb"
 username              = "ccmysqluser01"
 password              = "ccmysqluserpwd"

... [see more](remediation.md)

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 APRA CPG 234 → 💼 36h patch management controls — to manage the assessment and application of patches and other updates that address known vulnerabilities in a timely manner;77no data
💼 APRA CPG 234 → 💼 40 An important aspect of information asset life-cycle management involves minimising vulnerabilities and maintaining support. Information security exposures could arise from hardware and software which is outdated or has limited or no support (whether through a third party, a related party or in-house). Technology that is end-of-life5 , out-of-support or in extended support is typically less secure by design, has a dated security model and can take longer, or is unable, to be updated to address new threats.77no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [RDS.13] RDS automatic minor version upgrades should be enabled11no data
💼 AWS Well-Architected → 💼 OPS05-BP05 Perform patch management4no data
💼 CIS AWS v1.5.0 → 💼 2.3.2 Ensure Auto Minor Version Upgrade feature is Enabled for RDS Instances - Level 1 (Automated)11no data
💼 CIS AWS v2.0.0 → 💼 2.3.2 Ensure Auto Minor Version Upgrade feature is Enabled for RDS Instances - Level 1 (Automated)11no data
💼 CIS AWS v3.0.0 → 💼 2.3.2 Ensure Auto Minor Version Upgrade feature is Enabled for RDS Instances - Level 1 (Automated)11no data
💼 CIS AWS v4.0.0 → 💼 2.2.2 Ensure the Auto Minor Version Upgrade feature is enabled for RDS instances (Automated)1no data
💼 CIS AWS v4.0.1 → 💼 2.2.2 Ensure the Auto Minor Version Upgrade feature is enabled for RDS instances (Automated)1no data
💼 CIS AWS v5.0.0 → 💼 2.2.2 Ensure the Auto Minor Version Upgrade feature is enabled for RDS instances (Automated)1no data
💼 CIS AWS v6.0.0 → 💼 3.2.2 Ensure the Auto Minor Version Upgrade feature is enabled for RDS instances (Automated)1no data
💼 Cloudaware Framework → 💼 Infrastructure Modernization18no data
💼 FedRAMP High Security Controls → 💼 CM-5 Access Restrictions for Change (L)(M)(H)21416no data
💼 FedRAMP High Security Controls → 💼 CM-7 Least Functionality (L)(M)(H)31833no data
💼 FedRAMP High Security Controls → 💼 CM-11 User-installed Software (L)(M)(H)44no data
💼 FedRAMP High Security Controls → 💼 SI-2 Flaw Remediation (L)(M)(H)2723no data
💼 FedRAMP High Security Controls → 💼 SI-2(2) Automated Flaw Remediation Status (M)(H)8no data
💼 FedRAMP Low Security Controls → 💼 CM-5 Access Restrictions for Change (L)(M)(H)8no data
💼 FedRAMP Low Security Controls → 💼 CM-7 Least Functionality (L)(M)(H)29no data
💼 FedRAMP Low Security Controls → 💼 CM-11 User-installed Software (L)(M)(H)4no data
💼 FedRAMP Low Security Controls → 💼 SI-2 Flaw Remediation (L)(M)(H)23no data
💼 FedRAMP Moderate Security Controls → 💼 CM-5 Access Restrictions for Change (L)(M)(H)216no data
💼 FedRAMP Moderate Security Controls → 💼 CM-7 Least Functionality (L)(M)(H)333no data
💼 FedRAMP Moderate Security Controls → 💼 CM-11 User-installed Software (L)(M)(H)4no data
💼 FedRAMP Moderate Security Controls → 💼 SI-2 Flaw Remediation (L)(M)(H)223no data
💼 FedRAMP Moderate Security Controls → 💼 SI-2(2) Automated Flaw Remediation Status (M)(H)8no data
💼 ISO/IEC 27001:2013 → 💼 A.12.5.1 Installation of software on operational systems55no data
💼 ISO/IEC 27001:2022 → 💼 8.8 Management of technical vulnerabilities810no data
💼 NIST CSF v1.1 → 💼 DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events2026no data
💼 NIST CSF v1.1 → 💼 DE.CM-5: Unauthorized mobile code is detected1112no data
💼 NIST CSF v1.1 → 💼 ID.AM-2: Software platforms and applications within the organization are inventoried57no data
💼 NIST CSF v1.1 → 💼 ID.RA-1: Asset vulnerabilities are identified and documented1316no data
💼 NIST CSF v1.1 → 💼 PR.DS-6: Integrity checking mechanisms are used to verify software, firmware, and information integrity2227no data
💼 NIST CSF v1.1 → 💼 PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality)426no data
💼 NIST CSF v1.1 → 💼 PR.IP-3: Configuration change control processes are in place55no data
💼 NIST CSF v1.1 → 💼 PR.IP-12: A vulnerability management plan is developed and implemented79no data
💼 NIST CSF v1.1 → 💼 PR.PT-3: The principle of least functionality is incorporated by configuring systems to provide only essential capabilities2130no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events180no data
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events100no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events181no data
💼 NIST CSF v2.0 → 💼 ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained9no data
💼 NIST CSF v2.0 → 💼 ID.IM-01: Improvements are identified from evaluations45no data
💼 NIST CSF v2.0 → 💼 ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties59no data
💼 NIST CSF v2.0 → 💼 ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities60no data
💼 NIST CSF v2.0 → 💼 ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded46no data
💼 NIST CSF v2.0 → 💼 ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked49no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected187no data
💼 NIST SP 800-53 Revision 4 → 💼 SI-2 FLAW REMEDIATION622no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-2 Flaw Remediation6620no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-2(2) Flaw Remediation _ Automated Flaw Remediation Status18no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-2(4) Flaw Remediation _ Automated Patch Management Tools8no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-2(5) Flaw Remediation _ Automatic Software and Firmware Updates28no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-2(6) Flaw Remediation _ Removal of Previous Versions of Software and Firmware66no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-7(12) Software, Firmware, and Information Integrity _ Integrity Verification1921no data
💼 PCI DSS v3.2.1 → 💼 6.2 Ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor-supplied security patches.6no data
💼 PCI DSS v4.0.1 → 💼 6.3.3 All system components are protected from known vulnerabilities by installing applicable security patches/updates6no data
💼 PCI DSS v4.0 → 💼 6.3.3 All system components are protected from known vulnerabilities by installing applicable security patches/updates6no data
💼 UK Cyber Essentials → 💼 3.1 All software on in-scope devices must be licensed and supported66no data
💼 UK Cyber Essentials → 💼 3.3 All software on in-scope devices must have automatic updates enabled where possible22no data