Skip to content

Amazon MQ brokers should have automatic minor version upgrade enabled

Identifier

mq-enable-auto-minor-version-upgrade

Category

Identify > Vulnerability, patch, and version management

Description

This control checks whether Amazon MQ brokers have automatic minor version upgrades enabled. Enabling this feature ensures that brokers automatically receive minor software updates that include important security patches and bug fixes. Regular patching helps reduce the risk of known vulnerabilities and improves the stability of the messaging service.

This setting is controlled by auto_minor_version_upgrade = true in the Terraform configuration of the aws_mq_broker resource.

Non Compliant Example

Terraform
1
2
3
4
5
6
7
resource "aws_mq_broker" "foo" {
  broker_name        = "mq-broker"
  engine_type        = "ActiveMQ"
  engine_version     = "5.16.3"
  host_instance_type = "mq.t3.medium"
  ...
}

Remediation

To fix this violation, enable automatic minor version upgrades by setting auto_minor_version_upgrade = true:

Terraform
1
2
3
4
5
6
7
8
resource "aws_mq_broker" "foo" {
  broker_name        = "mq-broker"
  engine_type        = "ActiveMQ"
  engine_version     = "5.16.3"
  host_instance_type = "mq.t3.medium"
  auto_minor_version_upgrade = true
  ...
}

Extra Resources