Back to Checks
aws

ElastiCache Redis replication group has Multi-AZ enabled

elasticache_redis_cluster_multi_az_enabled
Service: elasticacheSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:Other

ElastiCache for Redis replication groups have Multi-AZ automatic failover enabled, distributing primary and replicas across distinct Availability Zones

Prowler logoProwlerprowler-provider-aws

Risk

Without Multi-AZ failover, a node or AZ outage can make Redis endpoints unreachable, reducing availability. Cold-cache rebuilds shift load to databases, risking saturation and cascading timeouts. Recent writes may be lost during failures, impacting integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elasticache_redis_cluster_multi_az_enabled

Recommendation

Enable Multi-AZ with automatic failover (MultiAZ: enabled) on Redis replication groups and place replicas in separate AZs. Use clients that follow primary/reader endpoints, monitor replication lag, and regularly test failover. Pair with snapshots for recovery; this enforces high availability and resilience.

Remediation

CLI

aws elasticache modify-replication-group --replication-group-id <example_resource_id> --multi-az-enabled --automatic-failover-enabled --apply-immediately

Terraform

# Enable Multi-AZ on an ElastiCache Redis replication group
resource "aws_elasticache_replication_group" "<example_resource_name>" {
  replication_group_id  = "<example_resource_id>"
  description           = "<description>"
  engine                = "redis"
  node_type             = "cache.t4g.small"
  number_cache_clusters = 2

  multi_az_enabled           = true  # CRITICAL: Enables Multi-AZ
  automatic_failover_enabled = true  # Required for Multi-AZ failover
}

NativeIaC

# CloudFormation: Enable Multi-AZ on an ElastiCache Redis replication group
Resources:
  <example_resource_name>:
    Type: AWS::ElastiCache::ReplicationGroup
    Properties:
      ReplicationGroupDescription: "<description>"
      Engine: redis
      CacheNodeType: cache.t4g.small
      NumCacheClusters: 2
      MultiAZEnabled: true  # CRITICAL: Enables Multi-AZ for the replication group

Other

1In the AWS Console, go to ElastiCache > Redis
2Select the target replication group
3Click Modify
4Enable Multi-AZ (and Automatic failover if prompted)
5Check Apply immediately and click Modify

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elasticache.elasticache_client import (
    elasticache_client,
)


class elasticache_redis_cluster_multi_az_enabled(Check):
    def execute(self):
        findings = []
        for repl_group in elasticache_client.replication_groups.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=repl_group)
            report.status = "FAIL"
            report.status_extended = f"Elasticache Redis cache cluster {repl_group.id} does not have Multi-AZ enabled."
            if repl_group.multi_az == "enabled":
                report.status = "PASS"
                report.status_extended = f"Elasticache Redis cache cluster {repl_group.id} has Multi-AZ enabled."

            findings.append(report)

        return findings

References