RDS.35: RDS clusters auto minor version upgrade

What does AWS Security Hub RDS.35 check?

RDS.35 checks the AutoMinorVersionUpgrade flag on a Multi-AZ DB cluster (AWS::RDS::DBCluster). It reports FAILED when the flag is off, meaning the cluster stays on its current minor version until a human intervenes. It is the cluster-level sibling of RDS.13's instance check.

Why does RDS.35 matter?

Minor versions ship bug fixes, performance improvements, and security patches. Disabling auto-upgrade is a common, well-intentioned mistake — teams turn it off to avoid surprise maintenance, intending to patch manually, then never do. Months pass, several versions accumulate, and the eventual catch-up is no longer a quiet automatic patch but a large, risky, multi-version jump needing change approval and downtime. It maps to NIST 800-53 SI-2 and PCI DSS 6.3.3.

How do I fix RDS.35?

1. Enable it with modify-db-cluster --auto-minor-version-upgrade.
2. Confirm the cluster's maintenance window sits in a low-traffic period.
3. Default it to true in IaC so new clusters inherit it.
4. Reserve pinned versions for clusters that genuinely require them, documented as exceptions.

# Enable auto minor version upgrade on every RDS instance that has it disabled.
for id in $(aws rds describe-db-instances \
    --query 'DBInstances[?AutoMinorVersionUpgrade==`false`].DBInstanceIdentifier' --output text); do
  aws rds modify-db-instance --db-instance-identifier "$id" \
    --auto-minor-version-upgrade --no-apply-immediately
done

# Move a deprecated Lambda function to a supported runtime.
aws lambda update-function-configuration --function-name auth-token-issuer \
  --runtime nodejs20.x

# Upgrade an out-of-support EKS control plane one minor version at a time (then catch up node groups).
aws eks update-cluster-version --name prod-payments --kubernetes-version 1.29