Ensure MQ Broker minor version updates are enabled
Error: AWS MQ Broker's minor version updates are disabled
Bridgecrew Policy ID: BC_AWS_GENERAL_113
Checkov Check ID: CKV_AWS_207
Severity: LOW
AWS MQ Broker's minor version updates are disabled
Description
When Amazon MQ supports a new version of a broker engine, you can upgrade your broker instances to the new version. There are two kinds of upgrades: major version upgrades and minor version upgrades. Minor upgrades helps maintain a secure and stable MQ broker with minimal impact on the application. For this reason, we recommend that your automatic minor upgrade is enabled. Minor version upgrades only occur automatically if a minor upgrade replaces an unsafe version, such as a minor upgrade that contains bug fixes for a previous version.
Fix - Runtime
CLI Command
aws mq update-broker \
--region ${region} \
--broker-id ${resource_id} \
--auto-minor-version-upgrade
Fix - Buildtime
CloudFormation
Resources:
Example:
Type: "AWS::AmazonMQ::Broker"
Properties:
BrokerName: example
EngineType: ActiveMQ
EngineVersion: "5.15.9"
HostInstanceType: mq.t3.micro
+ AutoMinorVersionUpgrade: true
Terraform
resource "aws_mq_broker" "example" {
broker_name = "example"
engine_type = "ActiveMQ"
engine_version = "5.15.9"
host_instance_type = "mq.t3.micro"
+ auto_minor_version_upgrade = true
}
Updated about 1 year ago