Project: KICS (Provisioning / Security & Compliance)
File: 3b6d777b-76e3-4133-80a3-0d6f667ade7f.md

title: Automatic Minor Upgrades Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 3b6d777b-76e3-4133-80a3-0d6f667ade7f Query name: Automatic Minor Upgrades Disabled Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Best Practices URL: RDS instance should have automatic minor upgrades enabled, which means the attribute 'autominorversion_upgrade' must be set to true.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="13" resource "awsdbinstance" "positive1" { allocated_storage = 20 storage_type = "gp2" engine = "mysql" engine_version = "5.7" instance_class = "db.t2.micro" name = "mydb" username = "foo" password = "foobarbaz" iamdatabaseauthentication_enabled = true storage_encrypted = true cacertidentifier = "rds-ca-2019" autominorversion_upgrade = false } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="11" module "db" { source = "terraform-aws-modules/rds/aws" version = "~> 3.0" identifier = "demodb" engine = "mysql" engine_version = "5.7.19" instance_class = "db.t2.large" allocated_storage = 5 autominorversion_upgrade = false name = "demodb" username = "user" password = "YourPwdShouldBeLongAndSecure!" port = "3306" iamdatabaseauthentication_enabled = true vpcsecuritygroup_ids = ["sg-12345678"] maintenance_window = "Mon:00:00-Mon:03:00" backup_window = "03:00-06:00" monitoring_interval = "30" monitoringrolename = "MyRDSMonitoringRole" createmonitoringrole = true tags = { Owner = "user" Environment = "dev" } subnet_ids = ["subnet-12345678", "subnet-87654321"] family = "mysql5.7" majorengineversion = "5.7" deletion_protection = true parameters = [ { name = "charactersetclient" value = "utf8mb4" }, { name = "charactersetserver" value = "utf8mb4" } ] options = [ { optionname = "MARIADBAUDIT_PLUGIN" option_settings = [ { name = "SERVERAUDITEVENTS" value = "CONNECT" }, { name = "SERVERAUDITFILE_ROTATIONS" value = "37" }, ] }, ] } ``` ```tf title="Negative test num. 1 - tf file" resource "awsdbinstance" "negative1" { allocated_storage = 20 storage_type = "gp2" engine = "mysql" engine_version = "5.7" instance_class = "db.t2.micro" name = "mydb" username = "foo" password = "foobarbaz" iamdatabaseauthentication_enabled = true storage_encrypted = true cacertidentifier = "rds-ca-2019" autominorversion_upgrade = true } ``` ```tf title="Negative test num. 2 - tf file" module "db" { source = "terraform-aws-modules/rds/aws" version = "~> 3.0" identifier = "demodb" engine = "mysql" engine_version = "5.7.19" instance_class = "db.t2.large" allocated_storage = 5 autominorversion_upgrade = true name = "demodb" username = "user" password = "YourPwdShouldBeLongAndSecure!" port = "3306" iamdatabaseauthentication_enabled = true vpcsecuritygroup_ids = ["sg-12345678"] maintenance_window = "Mon:00:00-Mon:03:00" backup_window = "03:00-06:00" monitoring_interval = "30" monitoringrolename = "MyRDSMonitoringRole" createmonitoringrole = true tags = { Owner = "user" Environment = "dev" } subnet_ids = ["subnet-12345678", "subnet-87654321"] family = "mysql5.7" majorengineversion = "5.7" deletion_protection = true parameters = [ { name = "charactersetclient" value = "utf8mb4" }, { name = "charactersetserver" value = "utf8mb4" } ] options = [ { optionname = "MARIADBAUDIT_PLUGIN" option_settings = [ { name = "SERVERAUDITEVENTS" value = "CONNECT" }, { name = "SERVERAUDITFILE_ROTATIONS" value = "37" }, ] }, ] } ```