Back to Checks
aws

DMS replication instance has Multi-AZ enabled

dms_instance_multi_az_enabled
Service: dmsSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsDmsReplicationInstance

AWS DMS replication instances are evaluated for Multi-AZ configuration. Instances with multi_az enabled are treated as having a cross-AZ standby; those without it are identified as single-AZ.

Prowler logoProwlerprowler-provider-aws

Risk

Without Multi-AZ, a single-AZ failure or maintenance event can halt migrations, causing extended downtime (availability) and replication gaps or rollbacks (integrity). Tasks may stall, increase cutover risk, and require manual recovery when the replication instance is unavailable.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks dms_instance_multi_az_enabled

Recommendation

Enable Multi-AZ (set multi_az to true) on DMS replication instances that handle production or time-sensitive migrations to ensure redundancy and automatic failover.

Apply HA principles: distribute across AZs, test failover, monitor health, and plan maintenance to minimize impact.

Remediation

CLI

aws dms modify-replication-instance --replication-instance-arn arn:aws:dms:<REGION>:<ACCOUNT_ID>:rep:<REPLICATION_ID> --multi-az --apply-immediately

Terraform

# Enable Multi-AZ on a DMS replication instance
resource "aws_dms_replication_instance" "<example_resource_name>" {
  replication_instance_id   = "<example_resource_name>"
  replication_instance_class = "dms.t3.micro"
  multi_az                  = true  # Critical: enables Multi-AZ to pass the check
}

NativeIaC

# CloudFormation: enable Multi-AZ on a DMS replication instance
Resources:
  <example_resource_name>:
    Type: AWS::DMS::ReplicationInstance
    Properties:
      ReplicationInstanceClass: dms.t3.micro
      MultiAZ: true  # Critical: enables Multi-AZ to pass the check

Other

1Open the AWS DMS console
2Go to Replication instances and select your instance
3Click Modify
4Check Multi-AZ
5Check Apply immediately
6Click Modify to save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.dms.dms_client import dms_client


class dms_instance_multi_az_enabled(Check):
    def execute(self):
        findings = []
        for instance in dms_client.instances:
            report = Check_Report_AWS(metadata=self.metadata(), resource=instance)
            report.status = "FAIL"
            report.status_extended = f"DMS Replication Instance {instance.id} does not have multi az enabled."
            if instance.multi_az:
                report.status = "PASS"
                report.status_extended = (
                    f"DMS Replication Instance {instance.id} has multi az enabled."
                )

            findings.append(report)

        return findings

References