Back to Checks
aws

Apache ActiveMQ broker is configured in active/standby Multi-AZ deployment mode

mq_broker_active_deployment_mode
Service: mqSeverity: low
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsAmazonMQBroker

ActiveMQ broker deployment mode is configured as active/standby (ACTIVE_STANDBY_MULTI_AZ), indicating a redundant pair operating across Availability Zones

Prowler logoProwlerprowler-provider-aws

Risk

Without active/standby, a single-instance broker becomes a single point of failure, degrading availability and risking message loss or duplication during outages or maintenance. This can stall message flows, grow backlogs, and cause inconsistent processing across dependent services.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks mq_broker_active_deployment_mode

Recommendation

Adopt active/standby deployment for ActiveMQ brokers to provide multi-AZ resilience.

Design clients for failover with retries and idempotent processing, validate recovery through regular failover testing, monitor broker health, and apply least privilege to limit blast radius.

Remediation

Terraform

# Create an ActiveMQ broker in active/standby Multi-AZ
resource "aws_mq_broker" "<example_resource_name>" {
  broker_name         = "<example_resource_name>"
  engine_type         = "ActiveMQ"
  engine_version      = "<example_resource_name>"
  host_instance_type  = "mq.t3.micro"
  publicly_accessible = false
  deployment_mode     = "ACTIVE_STANDBY_MULTI_AZ"  # Critical: enables active/standby Multi-AZ to pass the check

  subnet_ids      = ["<example_resource_id>", "<example_resource_id>"]  # Critical: two subnets in different AZs
  security_groups = ["<example_resource_id>"]

  user {
    username = "<example_resource_name>"
    password = "<example_resource_id>"
  }
}

NativeIaC

# CloudFormation: Create an ActiveMQ broker in active/standby Multi-AZ
Resources:
  <example_resource_name>:
    Type: AWS::AmazonMQ::Broker
    Properties:
      BrokerName: <example_resource_name>
      EngineType: ACTIVEMQ
      EngineVersion: <example_resource_name>
      HostInstanceType: mq.t3.micro
      PubliclyAccessible: false
      DeploymentMode: ACTIVE_STANDBY_MULTI_AZ  # Critical: sets active/standby Multi-AZ to pass the check
      SubnetIds:
        - <example_resource_id>
        - <example_resource_id>  # Critical: two subnets in different AZs required for active/standby
      SecurityGroups:
        - <example_resource_id>
      Users:
        - Username: <example_resource_name>
          Password: <example_resource_id>

Other

1In the AWS Console, go to Amazon MQ > Brokers > Create broker
2Select Engine: ActiveMQ
3Set Deployment mode to Active/standby broker (Multi-AZ)
4Choose two subnets in different AZs and a security group
5Enter a broker name, instance type, and create a user (username/password)
6Create the broker, update clients to use the new endpoints, then delete the old single-instance broker

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.mq.mq_client import mq_client
from prowler.providers.aws.services.mq.mq_service import DeploymentMode, EngineType


class mq_broker_active_deployment_mode(Check):
    def execute(self):
        findings = []
        for broker in mq_client.brokers.values():
            if broker.engine_type == EngineType.ACTIVEMQ:
                report = Check_Report_AWS(metadata=self.metadata(), resource=broker)
                report.status = "FAIL"
                report.status_extended = f"MQ Apache ActiveMQ Broker {broker.name} does not have an active/standby deployment mode."
                if broker.deployment_mode == DeploymentMode.ACTIVE_STANDBY_MULTI_AZ:
                    report.status = "PASS"
                    report.status_extended = f"MQ Apache ActiveMQ Broker {broker.name} does have an active/standby deployment mode."

                findings.append(report)

        return findings

References