Free plan Signups are open now. The full audytx engine — Terraform and CloudFormation — is live. The Free plan is 100 scans a month and stays free — paid tiers arrive Nov 01, 2026 from $20/month for unlimited repositories. Try it on your own code.

RDS automatic minor version upgrades are disabled

AWS_RDS_016 MEDIUM Security

What it checks

RDS automatic minor version upgrades are disabled

Where it applies

Terraform: aws_db_instance, aws_rds_cluster, aws_rds_cluster_instance

CloudFormation: AWS::RDS::DBInstance, AWS::RDS::DBCluster

How to fix it

  1. Set auto_minor_version_upgrade = true and set a maintenance_window outside peak traffic, so AWS applies engine security patches on a schedule you chose. This clears the finding and the matching Security Hub control (RDS.13 for a DB instance, RDS.35 for a DB cluster).
  2. If upgrades are deliberately manual (an installed extension pins the minor), keep a tested upgrade runbook and accept that this finding and the matching Security Hub control report the flag until it is turned back on; pinning engine_version to the complete minor does not clear either.

Vendor documentation

All rules