🛡️ AWS RDS Instance engine is outside standard support🟢

• Contextual name: 🛡️ Instance engine is outside standard support🟢
• ID: /ce/ca/aws/rds/instance-engine-support
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: RELIABILITY

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 AWS RDS Instance
  • 🔌 AWS RDS Instance - object.extracts.yaml
  • 🔌 AWS RDS Instance - instance-engine-support.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

This policy identifies standalone Amazon RDS for MySQL, PostgreSQL, and MariaDB instances whose engine major version is outside AWS standard support. It uses the instance's collected AWS lifecycle calendar rather than a fixed version list or the latest release.

Rationale

Running beyond standard support creates an upgrade obligation and can incur additional Extended Support charges. Extended Support provides temporary maintenance for eligible MySQL and PostgreSQL versions, with a published end date; it does not satisfy this policy's standard-support requirement. MariaDB has no RDS Extended Support option.

Findings require a tested major-version upgrade or a time-limited exception with verified support coverage. A finding during Extended Support does not mean that AWS has stopped providing all security fixes.

Impact

Engine upgrades can change database behavior and require downtime. Test application compatibility, extensions, replication, backups, and the upgrade path before modifying production databases. Delaying migration can increase costs and leave less time before final support expiry or an AWS-initiated upgrade.

... see more

Remediation

Open File

Remediation

Confirm the installed version and support dates

In the Amazon RDS console, select the standalone DB instance and confirm its engine, installed version, AWS Region, and status. Use the AWS CLI to inspect its configuration, lifecycle calendar, and valid upgrade targets:

aws rds describe-db-instances \
    --db-instance-identifier <database-id> \
    --region <region>

aws rds describe-db-major-engine-versions \
    --engine <engine> \
    --region <region>

aws rds describe-db-engine-versions \
    --engine <engine> \
    --engine-version <installed-version> \
    --include-all \
    --region <region> \
    --query 'DBEngineVersions[].{Engine:Engine,Version:EngineVersion,UpgradeTargets:ValidUpgradeTarget}'

Use Engine and EngineVersion from the instance response to identify the installed major version. Match these values to Engine and MajorEngineVersion in the lifecycle calendar response, then inspect SupportedEngineLifecycles by LifecycleSupportName for standard and Extended Support dates.

Major-version numbering differs by engine:

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 Cloudaware Framework → 💼 Infrastructure Modernization			39		no data