ElastiCache.2: ElastiCache is not auto-applying minor patches

What does AWS Security Hub ElastiCache.2 check?

ElastiCache.2 fails when a cluster has `AutoMinorVersionUpgrade` disabled, so the engine never automatically picks up minor patches. Memcached is exempt from the check.

Why does ElastiCache.2 matter?

A cluster launched once and never touched can sit on a minor engine version years out of date, missing security and stability patches the whole time. Because the data tier "just works," nobody revisits it until an auditor flags it under patch management, and then the burden is proving the same blind spot does not exist across the fleet.

How do I fix ElastiCache.2?

1. List clusters and check `AutoMinorVersionUpgrade` to find the ones with it disabled.
2. Modify each cluster to enable the flag (a one-line change); the upgrade itself rolls out during the next maintenance window with no downtime.
3. Confirm the maintenance window is set sensibly so upgrades land when you expect.
4. Keep planning deliberate major-version upgrades separately; this flag only covers automatic minor patches.

# Enable auto minor version upgrade on every RDS instance that has it disabled.
for id in $(aws rds describe-db-instances \
    --query 'DBInstances[?AutoMinorVersionUpgrade==`false`].DBInstanceIdentifier' --output text); do
  aws rds modify-db-instance --db-instance-identifier "$id" \
    --auto-minor-version-upgrade --no-apply-immediately
done

# Move a deprecated Lambda function to a supported runtime.
aws lambda update-function-configuration --function-name auth-token-issuer \
  --runtime nodejs22.x

# Upgrade an out-of-support EKS control plane one minor version at a time (then catch up node groups).
aws eks update-cluster-version --name prod-payments --kubernetes-version 1.29