RDS engine version pinned to the major version only, with automatic minor upgrades on
What it checks
RDS engine version pinned to the major version only, with automatic minor upgrades on
Where it applies
Terraform: aws_db_instance, aws_rds_cluster
CloudFormation: AWS::RDS::DBInstance, AWS::RDS::DBCluster
How to fix it
- Run `aws rds describe-db-engine-versions --engine <your engine>` and set engine_version to a COMPLETE version available for your engine and Region. Illustrative shapes include "15.4" for PostgreSQL 10+, "8.0.36" for MySQL, "10.4.30" for MariaDB, "15.00.4236.7.v1" for SQL Server and "19.0.0.0.ru-2026-04.rur-2026-04.r1" for Oracle. This configured value identifies the requested initial release, not necessarily the actual running version. Inspect engine_version_actual for an RDS instance or use `aws rds describe-db-instances` or `aws rds describe-db-clusters` for the running version.
- Decide auto_minor_version_upgrade and maintenance ownership deliberately. With it enabled, ordinary automatic minor upgrades depend on engine/version eligibility and applicable cluster/instance settings and run during maintenance. Test application and extension compatibility and maintain an upgrade runbook. With it off, you own ordinary minor upgrade planning, but critical security or end-of-support upgrades may still occur even when disabled; a complete pin is not a permanent service-upgrade lock. Where applicable, AWS_RDS_016 reports the disabled flag even with a complete pin. Do not turn the flag off merely to silence AWS_OPS_023.
Frameworks
- AWS Well-Architected REL.5
These mappings are advisory, not an attestation of compliance.