> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Auto Minor Version Upgrade flag Should Be Enabled ### More Info: Your RDS database instances should have the Auto Minor Version Upgrade flag enabled in order to receive automatically minor engine upgrades during the specified maintenance window ### Risk Level Low ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * AWS Well Architected Framework * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * Reserve Bank of India (RBI) Cyber Security Framework * Reserve Bank of India (RBI) Master Direction – Information Technology Framework * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the misconfiguration of the "Auto Minor Version Upgrade" flag not being enabled for an AWS RDS instance using the AWS Management Console, follow these steps: 1. **Sign in to the AWS Management Console**: Go to [https://aws.amazon.com/](https://aws.amazon.com/) and sign in to the AWS Management Console using your credentials. 2. **Navigate to the RDS Dashboard**: Click on the "Services" dropdown menu at the top of the page, select "RDS" under the Database category. 3. **Select the RDS Instance**: From the list of RDS instances, select the instance for which you want to enable the "Auto Minor Version Upgrade" flag by clicking on its identifier. 4. **Modify the Instance**: In the RDS dashboard for the selected instance, click on the "Modify" button located in the top right corner of the page. 5. **Enable Auto Minor Version Upgrade**: Scroll down to the "Backup" section of the Modify DB Instance page. Here, you will find the "Auto minor version upgrade" option. Check the box next to this option to enable automatic minor version upgrades for your RDS instance. 6. **Save Changes**: Scroll to the bottom of the page and click on the "Continue" button. 7. **Apply Changes**: Review the changes you are about to make and click on the "Modify DB Instance" button to apply the changes. 8. **Monitor the Status**: Once the modification is complete, monitor the status of the RDS instance to ensure that the "Auto Minor Version Upgrade" flag is now enabled. By following these steps, you have remediated the misconfiguration of the "Auto Minor Version Upgrade" flag not being enabled for your AWS RDS instance using the AWS Management Console. # To remediate the misconfiguration of the "Auto Minor Version Upgrade" flag not being enabled for an AWS RDS instance using AWS CLI, follow these steps: 1. **Identify the RDS Instance**: First, you need to identify the AWS RDS instance for which you want to enable the Auto Minor Version Upgrade flag. You can do this by listing all the RDS instances in your AWS account using the following AWS CLI command: ``` aws rds describe-db-instances ``` 2. **Enable Auto Minor Version Upgrade**: Once you have identified the RDS instance, you can enable the Auto Minor Version Upgrade flag by running the following AWS CLI command: ``` aws rds modify-db-instance --db-instance-identifier --auto-minor-version-upgrade --apply-immediately ``` Replace `` with the actual name of your RDS instance. 3. **Verify the Configuration**: After running the above command, the Auto Minor Version Upgrade flag should be enabled for your RDS instance. You can verify this by describing the RDS instance again using the AWS CLI command: ``` aws rds describe-db-instances --db-instance-identifier ``` Ensure that the `AutoMinorVersionUpgrade` parameter is set to `true` in the output. By following these steps, you can remediate the misconfiguration of the Auto Minor Version Upgrade flag not being enabled for an AWS RDS instance using AWS CLI. To remediate the misconfiguration of the "Auto Minor Version Upgrade" flag not being enabled for an AWS RDS instance using Python, you can use the AWS SDK for Python (Boto3) to update the RDS instance's configuration. Here are the step-by-step instructions: 1. Install Boto3: Ensure that you have the Boto3 library installed. You can install it using pip: ``` pip install boto3 ``` 2. Configure AWS Credentials: Make sure you have your AWS credentials configured either through environment variables, AWS CLI configuration, or IAM role assigned to the instance running the script. 3. Write Python script: Create a Python script with the following code to enable the "Auto Minor Version Upgrade" flag for the RDS instance: ```python theme={null} import boto3 # Initialize the RDS client rds_client = boto3.client('rds', region_name='your-aws-region') # Specify the RDS instance identifier db_instance_identifier = 'your-rds-instance-id' # Enable Auto Minor Version Upgrade for the specified RDS instance response = rds_client.modify_db_instance( DBInstanceIdentifier=db_instance_identifier, AutoMinorVersionUpgrade=True ) print(f"Auto Minor Version Upgrade enabled for RDS instance {db_instance_identifier}") ``` Make sure to replace `'your-aws-region'` with the AWS region where your RDS instance is located and `'your-rds-instance-id'` with the actual identifier of your RDS instance. 4. Run the script: Execute the Python script you created in step 3. This will enable the "Auto Minor Version Upgrade" flag for the specified RDS instance. 5. Verify: You can verify that the configuration has been updated by checking the RDS instance details in the AWS Management Console or by running describe\_db\_instances API call using Boto3. By following these steps, you can remediate the misconfiguration of the "Auto Minor Version Upgrade" flag not being enabled for an AWS RDS instance using Python and Boto3. ```hcl theme={null} resource "aws_db_instance" "THIS_DB_INSTANCE" { # Replace THIS_DB_INSTANCE with your resource name # Replace placeholders with your actual values identifier = "DB_INSTANCE_IDENTIFIER" engine = "DB_ENGINE" # e.g., "mysql" instance_class = "DB_INSTANCE_CLASS" # e.g., "db.t3.medium" allocated_storage = 20 # Enable automatic minor version upgrades during the maintenance window auto_minor_version_upgrade = true # ...any other required arguments (subnet_group_name, vpc_security_group_ids, etc.) } ``` This matches `aws rds modify-db-instance ... --auto-minor-version-upgrade` by enabling automatic minor version upgrades on the DB instance. Applying this change itself does not force resource replacement, but the actual minor version upgrade will occur during the next scheduled maintenance window and will cause a service interruption, as per the CLI warning. Verification: `terraform plan` should show `auto_minor_version_upgrade: "false" => "true"` (or from `null` to `true`) on the affected `aws_db_instance` without a `-/+` replacement indicator for the resource. ### Additional Reading: * [https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER\_UpgradeDBInstance.Upgrading.html](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Upgrading.html)