Back to Checks
aws

DocumentDB cluster has Multi-AZ enabled

documentdb_cluster_multi_az_enabled
Service: documentdbSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsRdsDbCluster

Amazon DocumentDB clusters with Multi-AZ (multi_az) indicate deployment of a primary and one or more replicas across Availability Zones.

Prowler logoProwlerprowler-provider-aws

Risk

Without Multi-AZ, the cluster depends on a single AZ/instance. An AZ or node failure-or maintenance-can stop reads and writes, causing downtime, timeouts, and SLA breaches. Availability degrades, RTO rises, and applications may experience failed or retried transactions until replacement capacity is created.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks documentdb_cluster_multi_az_enabled

Recommendation

Enable Multi-AZ for DocumentDB and distribute instances across distinct AZs.

  • Maintain at least one replica
  • Set promotion priorities to guide failover
  • Test failover regularly and use resilient client retries

This builds fault tolerance and preserves service availability.

Remediation

CLI

aws docdb create-db-instance --db-instance-identifier <example_resource_id> --db-cluster-identifier <example_resource_id> --db-instance-class <INSTANCE_CLASS> --engine docdb --availability-zone <OTHER_AZ>

Terraform

# Add a replica to enable Multi-AZ for an existing DocumentDB cluster
resource "aws_docdb_cluster_instance" "<example_resource_name>" {
  cluster_identifier = "<example_resource_id>"  # CRITICAL: adds a new instance to the cluster to achieve Multi-AZ
  instance_class     = "<INSTANCE_CLASS>"
  availability_zone  = "<OTHER_AZ>"             # CRITICAL: different AZ ensures Multi-AZ failover
}

NativeIaC

# CloudFormation: add a replica to enable Multi-AZ for an existing DocumentDB cluster
Resources:
  DocDBReplica:
    Type: AWS::DocDB::DBInstance
    Properties:
      DBClusterIdentifier: "<example_resource_id>"  # CRITICAL: adds a new instance to the cluster to achieve Multi-AZ
      DBInstanceClass: "<INSTANCE_CLASS>"
      AvailabilityZone: "<OTHER_AZ>"                # CRITICAL: place in a different AZ to provide Multi-AZ failover

Other

1In the AWS Console, go to Amazon DocumentDB and open your cluster
2Click Create instance
3Set Instance class and choose an Availability Zone different from the primary
4Click Create to add the replica
5Verify the cluster now shows Multi-AZ enabled

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.documentdb.documentdb_client import (
    documentdb_client,
)


class documentdb_cluster_multi_az_enabled(Check):
    def execute(self):
        findings = []
        for db_cluster in documentdb_client.db_clusters.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=db_cluster)
            report.status = "FAIL"
            report.status_extended = (
                f"DocumentDB Cluster {db_cluster.id} does not have Multi-AZ enabled."
            )
            if db_cluster.multi_az:
                report.status = "PASS"
                report.status_extended = (
                    f"DocumentDB Cluster {db_cluster.id} has Multi-AZ enabled."
                )

            findings.append(report)

        return findings

References