RDS instance does not have automatic minor version upgrades enabled

Severity: High
Service: RDS
Check ID: RDS_AUTO_MINOR_UPGRADE_DISABLED

What this check finds

Automatic minor version upgrades ensure the RDS instance receives database engine security patches automatically during the maintenance window. Without this, known vulnerabilities remain unpatched until a manual upgrade is performed.

Passing looks like: RDS automatic minor version upgrades enabled.

How to fix it

Enable automatic minor version upgrades.

AWS CLI

aws rds modify-db-instance --db-instance-identifier INSTANCE_ID --auto-minor-version-upgrade --apply-immediately

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

RDS → Databases → select instance → Modify → Maintenance → Auto minor version upgrade → Enable.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to RDS instance does not have automatic minor version upgrades enabled
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	2.2.2 Ensure the Auto Minor Version Upgrade feature is enabled for RDS instances
PCI-DSS v4.0.1	6.3 Security vulnerabilities are identified and addressed
NIST SP 800-53 Rev5 (Moderate)	SI-2 Flaw Remediation
NIST Cybersecurity Framework 2.0	ID.RA-01 Risk Assessment — Vulnerabilities are identified and recorded
ISO/IEC 27001:2022 Annex A	A.8.8 Management of technical vulnerabilities

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More RDS checks

All RDS checks