RDS changes applied immediately instead of in the maintenance window

What it checks

RDS changes applied immediately instead of in the maintenance window

Where it applies

Terraform: aws_db_instance

CloudFormation: AWS::RDS::DBInstance

How to fix it

1. Set apply_immediately = false (or remove the line — false is default). Set a maintenance_window to a low-traffic period; changes accumulate there.
2. If you genuinely need a now-or-never change (e.g. responding to a CVE), set it to true for the one apply and revert in the same PR.

Frameworks

• AWS Well-Architected OPS.6

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules