More Info:
Deprecated RDS Versions in Use. Avoid deprecated RDS Versions to avoid Security issues.Risk Level
HighAddress
Reliability, SecurityCompliance Standards
- APRA CPS 234 (Australia)
- BSI C5 (Germany)
- Brazil LGPD
- CCPA / CPRA (California)
- CIS Critical Security Controls v8
- CMMC 2.0
- CSA Cloud Controls Matrix v4
- Cloudanix Best Practice
- DPDPA
- Digital Operational Resilience Act (EU)
- Essential 8
- ISO/IEC 27017
- ISO/IEC 27018
- ISO/IEC 27701
- KSA PDPL
- MAS Technology Risk Management (Singapore)
- MITRE ATT&CK (Cloud)
- NIS2 Directive
- NIST SP 800-171
- NYDFS 23 NYCRR 500
- SWIFT Customer Security Controls Framework
- Sarbanes-Oxley IT General Controls
- Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
- UK NCSC Cyber Assessment Framework
Triage and Remediation
- Remediation
Remediation
Using Console
Using Console
To remediate the issue of using deprecated RDS versions in AWS, follow these steps using the AWS Management Console:
-
Identify the RDS Instances with Deprecated Versions:
- Log in to your AWS Management Console.
- Navigate to the RDS service.
- Click on “Databases” from the left-hand menu.
- Look for databases that are using deprecated RDS versions. These instances will be marked with a warning sign indicating that the version is deprecated.
-
Create a Snapshot of the RDS Instance:
- Before performing any upgrade, it is recommended to create a snapshot of your RDS instance for backup purposes.
- Select the RDS instance that you want to upgrade.
- Click on the “Instance actions” dropdown menu.
- Select “Take snapshot” and provide a name for the snapshot.
-
Modify the RDS Instance:
- Select the RDS instance that you want to upgrade.
- Click on the “Modify” button.
- In the Modify RDS Instance window, select the desired RDS engine version that is supported and not deprecated.
- Review the other configuration settings if needed.
- Click on the “Continue” button.
-
Apply the Changes:
- Review the changes you made in the Modify RDS Instance window.
- Scroll down and click on the “Modify DB Instance” button to apply the changes.
- AWS will schedule a maintenance window for the upgrade process. The actual upgrade will happen during this maintenance window.
-
Monitor the Upgrade Process:
- Once the maintenance window starts, AWS will automatically upgrade the RDS instance to the new version.
- Monitor the upgrade process from the RDS console to ensure that it completes successfully.
-
Verify the Upgrade:
- After the upgrade process is completed, verify that the RDS instance is now running on the new, non-deprecated version.
- Test your applications to ensure that they are working as expected with the upgraded RDS instance.
Using CLI
Using CLI
To remediate the issue of using deprecated RDS versions in AWS RDS using AWS CLI, you can follow these steps:
- List all the RDS instances and their engine versions currently in use:
- Identify the RDS instances that are using deprecated engine versions. You can refer to the AWS RDS documentation to check for the latest supported engine versions.
- Create a snapshot of the RDS instance that is using the deprecated engine version:
- Delete the RDS instance that is using the deprecated engine version:
- Create a new RDS instance with the latest supported engine version using the snapshot created earlier:
- Update any necessary configurations or settings on the new RDS instance as per your requirements.
- Test the new RDS instance to ensure that it is functioning correctly with the latest supported engine version.
Using Python
Using Python
To remediate the issue of using deprecated RDS versions in AWS using Python, you can follow these steps:Make sure to replace
-
Identify the deprecated RDS versions in use:
- Use the AWS SDK for Python (Boto3) to list all the RDS instances in your account.
- Check the engine version of each RDS instance against the list of deprecated versions provided by AWS.
-
Upgrade the RDS instances:
- For each RDS instance using a deprecated version, create a snapshot of the instance.
- Modify the RDS instance to upgrade to a supported version using the
modify_db_instancemethod in Boto3. - Wait for the modification to be completed before proceeding to the next step.
-
Test the upgraded RDS instances:
- Verify that the RDS instances are functioning correctly after the upgrade.
- Check if any applications or services relying on these RDS instances are working as expected.
-
Cleanup:
- Once you have confirmed that all RDS instances have been successfully upgraded, you can delete the snapshots created in step 2 to save costs and reduce clutter in your account.
'your_deprecated_version_1', 'your_deprecated_version_2', and 'your_supported_version' with the actual deprecated and supported RDS versions provided by AWS.Run this script in your AWS environment to remediate the issue of using deprecated RDS versions.Using Terraform
Using Terraform
aws rds create-db-snapshot) as a persistent resource without creating new snapshots on every apply; create that snapshot manually (or via a one-off script) before applying this change.This change upgrades the existing DB instance in place (no Terraform resource replacement), but engine_version plus apply_immediately = true will cause a service outage while AWS performs the modification. If you prefer to use the next maintenance window instead, set apply_immediately = false.terraform plan should show an in-place update of aws_db_instance.THIS_DB, changing engine_version (and possibly parameter_group_name, allow_major_version_upgrade, and apply_immediately) with no -/+ replacement indicators.
