- Newest
- Most votes
- Most comments
While the re:Post Agent's answer explains the theory well, it might not solve your specific issue since you mentioned you already configured the policy and tags. If your instances are still falling back to the "Second" rollout order, here are the most common practical pitfalls to check:
- Case-Sensitivity of Tags: This is the #1 reason policies fail to apply. The tags defined in your Organizations rollout policy JSON are strictly case-sensitive. If your policy targets
{"env": "prod"}, but the tag on your RDS instance isEnv: Prod, the policy will ignore the resource and default to "Second". Double-check the exact capitalization. - Verify Policy Attachment: Ensure the policy is not just created in the management account, but explicitly attached to the specific member account or Organizational Unit (OU) where your PostgreSQL instances reside.
- Other Maintenance Activities: You mentioned other maintenance stopped as well. It's important to note that the upgrade rollout policy only applies to RDS minor engine upgrades. It does not control OS updates or hardware maintenance. If those stopped, it’s likely a coincidence (e.g., AWS simply hasn't scheduled any OS patches for your instance class recently).
- Pending Target Version: Since you are already on 16.8, verify via the AWS CLI or Console if AWS has even designated a newer version (like 16.9 or 16.10) as an official Auto Minor Version Upgrade target for your specific region yet. If there is no target, no upgrades will be scheduled.
Hope this helps you narrow down the issue!
Based on the information about the AWS Organizations upgrade rollout policy for automatic minor version upgrades, the behavior you're experiencing is actually expected. When resources are not explicitly configured with an upgrade policy or are excluded from the policy, they automatically receive an upgrade order of "second" by default.
Here are some key points to help you understand and resolve the situation:
Why your instances show "Second" order: Resources that aren't properly tagged or configured within the upgrade rollout policy will default to the "second" upgrade order. This is the standard behavior for resources that don't have explicit upgrade order assignments.
How the upgrade rollout policy works: The policy defines three upgrade orders: first, second, and last. When a new minor version becomes eligible for automatic upgrade, resources marked as "first" (typically development environments) are upgraded initially. After a designated validation or "bake time" period, resources with "second" order become eligible. Finally, after another bake time, "last" order resources (typically production) become eligible.
What you need to verify:
- Ensure your AWS account is part of an organization with the upgrade rollout policy properly enabled
- Confirm that automatic minor version upgrades are enabled for your RDS instances
- Verify that your resources are correctly tagged to identify their environment and upgrade order
- Remember that changes to the policy or resource tags require time to propagate through the system
Important consideration: The upgrade rollout policy only applies to Amazon RDS resources that have automatic minor version upgrades enabled. Make sure this setting is turned on for your instances.
If you've configured everything correctly but still see issues, the delay might be due to the propagation time needed for policy and tag changes to take effect across your organization.
Sources
Using AWS Organizations upgrade rollout policy for automatic minor version upgrades - Amazon Relational Database Service
Automatic minor version upgrades for RDS for PostgreSQL - Amazon Relational Database Service
AWS Organizations now supports upgrade rollout policy for Amazon Aurora and Amazon RDS - AWS
I have missed part of information. Upgrade rollout policy and tags were configured to set "First" upgrade order
The issue with "rollout order as Second" was in misaligned RDS instance tags and upgrade rollout policy The issue with stuck upgrade on 16.8 has gone after manual upgrade to 16.10.