CloudWiki
Rules
Medium

Ensure RDS instances are configured with Auto Minor Version Upgrade

Security & Compliance
Description

To keep up with new features, bug fixes, and security patches for database engines, AWS RDS occasionally replaces minor engine versions with new ones that require upgrading. A version change is considered minor when the last version number within the release is replaced (e.g., 5.6.26 to 5.6.27). By enabling the Auto Minor Version Upgrade feature, the RDS instances can automatically receive version upgrades during the designated maintenance window. It is important to note that AWS tests and approves each version upgrade before making it available. Therefore, ensure that your RDS database instances have the Auto Minor Version Upgrade flag enabled to receive these upgrades automatically.

Remediation

Enabling Auto Minor Version Upgrade for your RDS (Relational Database Service) instances is essential to keep them up to date with new features, bug fixes, and security patches. The following are remediation steps to ensure RDS instances are configured with Auto Minor Version Upgrade:

  1. Identify the RDS instances that are not configured with Auto Minor Version Upgrade. You can use the AWS Management Console or AWS CLI to identify the RDS instances that are not enabled with this feature.
  2. Evaluate the impact of enabling Auto Minor Version Upgrade on each RDS instance. Enabling this feature may require additional resources and could result in increased costs. Therefore, it's crucial to assess the potential impact on each RDS instance and determine if the benefits of Auto Minor Version Upgrade outweigh the costs.
  3. Take a snapshot of each RDS instance before enabling Auto Minor Version Upgrade. Taking a snapshot ensures that you have a backup of your data before making any changes.
  4. Enable Auto Minor Version Upgrade for each RDS instance using the AWS Management Console or AWS CLI. The process of enabling Auto Minor Version Upgrade involves modifying the RDS instance's configuration to automatically upgrade to the latest version during the specified maintenance window.
  5. Monitor the RDS instances after enabling Auto Minor Version Upgrade. It's essential to monitor the RDS instances to ensure that they are functioning correctly and to detect any issues that may arise.
  6. Test the upgrade process. Once Auto Minor Version Upgrade is enabled, you should test the upgrade process to ensure that it works correctly. You can simulate a version upgrade by manually triggering an upgrade during the maintenance window.
  7. Review the AWS documentation and best practices for Auto Minor Version Upgrade. AWS provides extensive documentation and best practices for configuring Auto Minor Version Upgrade, which you should review to ensure that you are using it correctly.

By following these steps, you can ensure that your RDS instances are configured with Auto Minor Version Upgrade, which can keep them up to date with new features, bug fixes, and security patches for their database engines.

Enforced Resources
Note: Remediation steps provided by Lightlytics are meant to be suggestions and guidelines only. It is crucial to thoroughly verify and test any remediation steps before applying them to production environments. Each organization's infrastructure and security needs may differ, and blindly applying suggested remediation steps without proper testing could potentially cause unforeseen issues or vulnerabilities. Therefore, it is strongly recommended that you validate and customize any remediation steps to meet your organization's specific requirements and ensure that they align with your security policies and best practices.