Pipeline: 2.2.2 Ensure the Auto Minor Version Upgrade feature is enabled for RDS instances
Description
Ensure that RDS database instances have the Auto Minor Version Upgrade flag enabled in order to receive automatically minor engine upgrades during the specified maintenance window. So, RDS instances can get the new features, bug fixes, and security patches for their database engines.
AWS RDS will occasionally deprecate minor engine versions and provide new ones for an upgrade. When the last version number within the release is replaced, the version changed is considered minor. With Auto Minor Version Upgrade feature enabled, the version upgrades will occur automatically during the specified maintenance window so your RDS instances can get the new features, bug fixes, and security patches for their database engines.
Remediation
From Console:
- Log in to the AWS management console and navigate to the RDS dashboard at https://console.aws.amazon.com/rds/.
- In the left navigation panel, click on
Databases
. - Select the RDS instance that wants to update.
- Click on the
Modify
button placed on the top right side. - On the
Modify DB Instance
:<instance identifier>
page, In theMaintenance
section, selectAuto minor version upgrade
click on theYes
radio button. - At the bottom of the page click on
Continue
, check toApply Immediately
to apply the changes immediately, or selectApply during the next scheduled maintenance window
to avoid any downtime. - Review the changes and click on
Modify DB Instance
. The instance status should change from available to modifying and back to available. Once the feature is enabled, theAuto Minor Version Upgrade
status should change toYes
.
From Command Line:
- Run
describe-db-instances
command to list all RDS database instance names, available in the selected AWS region:
aws rds describe-db-instances --region <regionName> --query 'DBInstances[*].DBInstanceIdentifier'
- The command output should return each database instance identifier.
- Run the
modify-db-instance
command to modify the configuration of a selected RDS instance. This command will apply the changes immediately. Remove--apply-immediately
to apply changes during the next scheduled maintenance window and avoid any downtime:
aws rds modify-db-instance --region <regionName> --db-instance-identifier <dbInstanceIdentifier> --auto-minor-version-upgrade --apply-immediately
- The command output should reveal the new configuration metadata for the RDS instance, including the
AutoMinorVersionUpgrade
parameter value. - Run
describe-db-instances
command to check if the Auto Minor Version Upgrade feature has been successfully enabled::
aws rds describe-db-instances --region <regionName> --db-instance-identifier <dbInstanceIdentifier> --query 'DBInstances[*].AutoMinorVersionUpgrade'
- The command output should return the feature's current status set to
true
, indicating that the feature isenabled
, and that the minor engine upgrades will be applied to the selected RDS instance.
Run the pipeline
To run this pipeline from your terminal:
flowpipe pipeline run aws_cis.pipeline.cis_v400_2_2_2
Use this pipeline
To call this pipeline from your pipeline, use a step:
step "pipeline" "step_name" { pipeline = aws_cis.pipeline.cis_v400_2_2_2 }
Params
Name | Type | Required | Description | Default |
---|---|---|---|---|
database | connection.steampipe | Yes | Database connection string. | connection.steampipe.default |
notifier | notifier | Yes | The name of the notifier to use for sending notification messages. | notifier.default |
notification_level | string | Yes | The verbosity level of notification messages to send. Valid options are 'verbose', 'info', 'error'. | info |
approvers | list(notifier) | Yes | List of notifiers to be used for obtaining action/approval decisions. | notifier.default |
Outputs
This pipeline has no outputs.