Back to Checks
aws

FSx Windows file system is configured for Multi-AZ deployment

fsx_windows_file_system_multi_az_enabled
Service: fsxSeverity: low
OfficialBuilt-inVerified
Categories:resilience
Resource Type:Other

FSx for Windows File Server file systems are evaluated for Multi-AZ deployment, determined when SubnetIds include more than one subnet in different Availability Zones.

Prowler logoProwlerprowler-provider-aws

Risk

Using Single-AZ creates a single point of failure. AZ outages, server failures, or maintenance can cause extended file share downtime, impacting availability. Crash scenarios may leave data inconsistent, threatening integrity, and recovery may rely on backups, increasing RTO/RPO.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks fsx_windows_file_system_multi_az_enabled

Recommendation

Prefer MULTI_AZ_1 for production to uphold high availability and avoid AZ-level single points of failure. Apply resilience and defense in depth: design to tolerate AZ loss, capacity-plan for failover, and test failover regularly. If Single-AZ is unavoidable, limit to noncritical or app-replicated workloads and keep frequent, verified backups.

Remediation

Terraform

# Terraform: FSx for Windows File Server configured for Multi-AZ
resource "aws_fsx_windows_file_system" "<example_resource_name>" {
  storage_capacity    = 32
  subnet_ids          = ["<example_subnet_id_1>", "<example_subnet_id_2>"] # CRITICAL: two subnets in different AZs
  throughput_capacity = 8
  deployment_type     = "MULTI_AZ_1"                                      # CRITICAL: enables Multi-AZ deployment
  preferred_subnet_id = "<example_subnet_id_1>"
}

NativeIaC

# CloudFormation: Create FSx for Windows File Server with Multi-AZ
Resources:
  <example_resource_name>:
    Type: AWS::FSx::FileSystem
    Properties:
      FileSystemType: WINDOWS
      StorageCapacity: 32
      SubnetIds:
        - <example_subnet_id_1>  # CRITICAL: two subnets -> Multi-AZ across AZs
        - <example_subnet_id_2>  # CRITICAL: two subnets -> Multi-AZ across AZs
      WindowsConfiguration:
        ThroughputCapacity: 8
        DeploymentType: MULTI_AZ_1  # CRITICAL: enables Multi-AZ deployment
        PreferredSubnetId: <example_subnet_id_1>

Other

1In AWS Console, go to FSx > Create file system > Amazon FSx for Windows File Server
2Set Deployment type to Multi-AZ
3Select two Subnets in different Availability Zones
4Set minimal required capacity/throughput and Create
5Migrate data to the new file system and repoint clients to its DNS name
6Delete the old Single-AZ file system

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.fsx.fsx_client import fsx_client


class fsx_windows_file_system_multi_az_enabled(Check):
    def execute(self):
        findings = []
        for file_system in fsx_client.file_systems.values():
            if file_system.type == "WINDOWS":
                report = Check_Report_AWS(
                    metadata=self.metadata(), resource=file_system
                )
                if len(file_system.subnet_ids) > 1:
                    report.status = "PASS"
                    report.status_extended = f"FSx Windows file system {file_system.id} is configured for Multi-AZ deployment."

                else:
                    report.status = "FAIL"
                    report.status_extended = f"FSx Windows file system {file_system.id} is not configured for Multi-AZ deployment."

                findings.append(report)

        return findings

References