cis-aws-foundations-3-2-2

name	cis-aws-foundations-3.2.2
description	Ensure the Auto Minor Version Upgrade feature is enabled for RDS instances
category	cis-storage
version	7.0.0
author	cyberstrike-official
tags	["cis","aws","storage","rds","patching","auto-upgrade","version-management"]
cis_id	3.2.2
cis_benchmark	CIS AWS Foundations Benchmark v7.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-foundations-3.2.1","cis-aws-foundations-3.2.3","cis-aws-foundations-3.2.4"]
prerequisites	[]
severity_boost	{}

Ensure the Auto Minor Version Upgrade feature is enabled for RDS instances

Description

Ensure that RDS database instances have the Auto Minor Version Upgrade flag enabled to automatically receive minor engine upgrades during the specified maintenance window. This way, RDS instances can obtain new features, bug fixes, and security patches for their database engines.

Rationale

AWS RDS will occasionally deprecate minor engine versions and provide new ones for upgrades. When the last version number within a release is replaced, the changed version is considered minor. With the Auto Minor Version Upgrade feature enabled, version upgrades will occur automatically during the specified maintenance window, allowing your RDS instances to receive new features, bug fixes, and security patches for their database engines.

Impact

Automatic minor version upgrades may introduce changes during maintenance windows. For critical production databases, consider testing upgrades in a staging environment first.

Audit Procedure

Using AWS Console

1. Log in to the AWS management console and navigate to the RDS dashboard at https://console.aws.amazon.com/rds/.
2. In the left navigation panel, click Databases.
3. Select the RDS instance that you want to examine.
4. Click on the Maintenance and backups panel.
5. Under the Maintenance section, search for the Auto Minor Version Upgrade status.
   • If the current status is Disabled, it means that the feature is not enabled, and the minor engine upgrades released will not be applied to the selected RDS instance.

Using AWS CLI

1. Run the describe-db-instances command to list all RDS database names available in the selected AWS region:

aws rds describe-db-instances --region --query 'DBInstances[*].[DBInstanceIdentifier,AutoMinorVersionUpgrade]' --output table

2. The command output should return each database instance identifier.

3. Run the describe-db-instances command again using a RDS instance identifier returned earlier to determine the Auto Minor Version Upgrade status for the selected instance:

aws rds describe-db-instances --region <region-name> --db-instance-identifier <db-instance-identifier> --query 'DBInstances[*].AutoMinorVersionUpgrade'