RDS database instance should have the 'Auto Minor Version Upgrade' flag enabled

Docs > Datadog Security > OOTB Rules > RDS database instance should have the 'Auto Minor Version Upgrade' flag enabled

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Description

Ensure that RDS database instances have the Auto Minor Version Upgrade flag enabled in order to automatically receive minor engine upgrades (features, bug fixes, and security patches) during the specified maintenance window.

Rationale

AWS RDS will occasionally deprecate minor engine versions and provide new ones for an upgrade. When the last version number in the release is replaced, the version change is considered minor. With the Auto Minor Version Upgrade feature enabled, the version upgrades will occur automatically during the specified maintenance window.

Impact

Creation, management, and storage of Customer-Managed Keys (CMKs) may require additional time assistance from an administrator.

Remediation

From the console

Log in to the AWS management console and navigate to the RDS dashboard.
In the left navigation panel, click Databases.
Select the RDS instance that you’d like to update.
Click the Modify button on the upper-right corner of the page.
Locate the Maintenance section of the Modify DB Instance: page, select Auto minor version upgrade, and then click Yes.
At the bottom of the page, click Continue, then select Immediately to apply the changes immediately or Apply during the next scheduled maintenance window to avoid any downtime.
Review the changes and click Modify DB Instance. The instance status should change from available to modifying, and then back to available. Once the feature is enabled, the Auto Minor Version Upgrade status should change to Yes.

From the command line

Run the following command to list all RDS database instances that are available in the selected AWS region:
```
aws rds describe-db-instances --region <regionName> --query 'DBInstances[*].DBInstanceIdentifier'
```
Run the following command to modify the selected RDS instance configuration and apply the changes immediately. To avoid downtime, you can remove –apply-immediately to apply the changes during the next scheduled maintenance window:
```
aws rds modify-db-instance --region <regionName> \
--db-instance-identifier <dbInstanceIdentifier> \
--auto-minor-version-upgrade \
--apply-immediately
```
The command output returns the new configuration metadata for the RDS instance along with the AutoMinorVersionUpgrade parameter value. To verify that the Auto Minor Version Upgrade feature has been successfully enabled, run the following command:
```
aws rds describe-db-instances --region <regionName> \
--db-instance-identifier <dbInstanceIdentifier> \
--query 'DBInstances[*].AutoMinorVersionUpgrade'
```

If the command output returns the current status as true, the feature is successfully enabled.