Back to Checks
aws

DynamoDB Accelerator (DAX) cluster has nodes in multiple Availability Zones

dynamodb_accelerator_cluster_multi_az
Service: dynamodbSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:Other

Amazon DynamoDB Accelerator (DAX) cluster node placement across Availability Zones is evaluated. Clusters with nodes in more than one AZ within the Region are recognized as multi-AZ; clusters whose nodes reside in a single AZ are recognized as single-AZ.

Prowler logoProwlerprowler-provider-aws

Risk

Without multi-AZ DAX nodes, an AZ outage or primary node failure can render the cache unavailable, harming availability and causing latency spikes and throttling as load shifts to DynamoDB. Loss of caching can drive higher costs and trigger timeout cascades in read-heavy workloads.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks dynamodb_accelerator_cluster_multi_az

Recommendation

Deploy DAX clusters with at least 3 nodes spread across distinct Availability Zones to ensure fault tolerance. Use subnet groups spanning multiple AZs, access via the cluster endpoint, and validate failover regularly. Monitor capacity to avoid single-AZ or single-node dependencies.

Remediation

CLI

aws dax increase-replication-factor --cluster-name <example_resource_name> --new-replication-factor 2 --availability-zones <AZ_1> <AZ_2>

Terraform

resource "aws_dax_cluster" "example" {
  cluster_name       = "<example_resource_name>"
  node_type          = "<NODE_TYPE>"
  replication_factor = 2  # CRITICAL: at least 2 nodes to allow multi-AZ
  iam_role_arn       = "<example_resource_id>"
  subnet_group_name  = "<example_resource_name>"
  availability_zones = ["<AZ_1>", "<AZ_2>"]  # CRITICAL: ensures nodes are in multiple AZs
}

NativeIaC

Resources:
  DAXCluster:
    Type: AWS::DAX::Cluster
    Properties:
      ClusterName: <example_resource_name>
      IAMRoleARN: <example_resource_id>
      NodeType: <NODE_TYPE>
      ReplicationFactor: 2  # CRITICAL: at least 2 nodes so nodes can be placed in multiple AZs
      SubnetGroupName: <example_resource_name>
      AvailabilityZones:     # CRITICAL: specify multiple AZs to ensure multi-AZ placement
        - <AZ_1>
        - <AZ_2>

Other

1In AWS Console, go to DynamoDB > DAX > Subnet groups and ensure the subnet group used by the cluster includes subnets from at least two Availability Zones; save if you add one.
2Go to DynamoDB > DAX > Clusters, select <example_resource_name>, and choose Modify.
3Set Cluster size to 2 or more.
4In Availability Zones (or node placement), select at least two different AZs.
5Save changes and wait until status is Available, then confirm nodes show multiple AZs in Cluster details.

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.dynamodb.dax_client import dax_client


class dynamodb_accelerator_cluster_multi_az(Check):
    def execute(self):
        findings = []
        for cluster in dax_client.clusters:
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.status = "FAIL"
            report.status_extended = f"DAX cluster {cluster.name} does not have nodes in multiple availability zones."
            if len(cluster.node_azs) > 1:
                report.status = "PASS"
                report.status_extended = f"DAX cluster {cluster.name} has nodes in multiple availability zones."
            findings.append(report)
        return findings

References