More Info:
Your RDS database instances should have the Auto Minor Version Upgrade flag enabled in order to receive automatically minor engine upgrades during the specified maintenance windowRisk Level
LowAddress
SecurityCompliance Standards
- APRA CPS 234 (Australia)
- AWS Well Architected Framework
- BSI C5 (Germany)
- Brazil LGPD
- CCPA / CPRA (California)
- CIS Critical Security Controls v8
- CMMC 2.0
- CSA Cloud Controls Matrix v4
- DPDPA
- Digital Operational Resilience Act (EU)
- Essential 8
- ISO/IEC 27017
- ISO/IEC 27018
- ISO/IEC 27701
- KSA PDPL
- MAS Technology Risk Management (Singapore)
- MITRE ATT&CK (Cloud)
- NIS2 Directive
- NIST CSF
- NIST SP 800-171
- NYDFS 23 NYCRR 500
- Reserve Bank of India (RBI) Cyber Security Framework
- Reserve Bank of India (RBI) Master Direction – Information Technology Framework
- SOC2
- SWIFT Customer Security Controls Framework
- Sarbanes-Oxley IT General Controls
- Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
- UK NCSC Cyber Assessment Framework
Triage and Remediation
- Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of the “Auto Minor Version Upgrade” flag not being enabled for an AWS RDS instance using the AWS Management Console, follow these steps:
- Sign in to the AWS Management Console: Go to https://aws.amazon.com/ and sign in to the AWS Management Console using your credentials.
- Navigate to the RDS Dashboard: Click on the “Services” dropdown menu at the top of the page, select “RDS” under the Database category.
- Select the RDS Instance: From the list of RDS instances, select the instance for which you want to enable the “Auto Minor Version Upgrade” flag by clicking on its identifier.
- Modify the Instance: In the RDS dashboard for the selected instance, click on the “Modify” button located in the top right corner of the page.
- Enable Auto Minor Version Upgrade: Scroll down to the “Backup” section of the Modify DB Instance page. Here, you will find the “Auto minor version upgrade” option. Check the box next to this option to enable automatic minor version upgrades for your RDS instance.
- Save Changes: Scroll to the bottom of the page and click on the “Continue” button.
- Apply Changes: Review the changes you are about to make and click on the “Modify DB Instance” button to apply the changes.
- Monitor the Status: Once the modification is complete, monitor the status of the RDS instance to ensure that the “Auto Minor Version Upgrade” flag is now enabled.
Using CLI
Using CLI
To remediate the misconfiguration of the “Auto Minor Version Upgrade” flag not being enabled for an AWS RDS instance using AWS CLI, follow these steps:
-
Identify the RDS Instance: First, you need to identify the AWS RDS instance for which you want to enable the Auto Minor Version Upgrade flag. You can do this by listing all the RDS instances in your AWS account using the following AWS CLI command:
-
Enable Auto Minor Version Upgrade: Once you have identified the RDS instance, you can enable the Auto Minor Version Upgrade flag by running the following AWS CLI command:
Replace
<your-rds-instance-name>with the actual name of your RDS instance. -
Verify the Configuration: After running the above command, the Auto Minor Version Upgrade flag should be enabled for your RDS instance. You can verify this by describing the RDS instance again using the AWS CLI command:
Ensure that the
AutoMinorVersionUpgradeparameter is set totruein the output.
Using Python
Using Python
To remediate the misconfiguration of the “Auto Minor Version Upgrade” flag not being enabled for an AWS RDS instance using Python, you can use the AWS SDK for Python (Boto3) to update the RDS instance’s configuration. Here are the step-by-step instructions:
-
Install Boto3: Ensure that you have the Boto3 library installed. You can install it using pip:
- Configure AWS Credentials: Make sure you have your AWS credentials configured either through environment variables, AWS CLI configuration, or IAM role assigned to the instance running the script.
-
Write Python script: Create a Python script with the following code to enable the “Auto Minor Version Upgrade” flag for the RDS instance:
Make sure to replace
'your-aws-region'with the AWS region where your RDS instance is located and'your-rds-instance-id'with the actual identifier of your RDS instance. - Run the script: Execute the Python script you created in step 3. This will enable the “Auto Minor Version Upgrade” flag for the specified RDS instance.
- Verify: You can verify that the configuration has been updated by checking the RDS instance details in the AWS Management Console or by running describe_db_instances API call using Boto3.
Using Terraform
Using Terraform
aws rds modify-db-instance ... --auto-minor-version-upgrade by enabling automatic minor version upgrades on the DB instance. Applying this change itself does not force resource replacement, but the actual minor version upgrade will occur during the next scheduled maintenance window and will cause a service interruption, as per the CLI warning.Verification: terraform plan should show auto_minor_version_upgrade: "false" => "true" (or from null to true) on the affected aws_db_instance without a -/+ replacement indicator for the resource.
