Back to Checks
aws

MQ RabbitMQ broker has cluster (multi-AZ) deployment mode

mq_broker_cluster_deployment_mode
Service: mqSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsAmazonMQBroker

Amazon MQ RabbitMQ brokers are assessed for cluster deployment mode (CLUSTER_MULTI_AZ) with nodes spread across multiple AZs and shared state.

Brokers configured otherwise are identified.

Prowler logoProwlerprowler-provider-aws

Risk

Without clustered RabbitMQ, the broker is a single point of failure. An instance or AZ outage can halt queues, cause message loss or duplication, and break ordering, reducing availability and integrity of workloads that depend on the broker.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks mq_broker_cluster_deployment_mode

Recommendation

Use cluster deployment (CLUSTER_MULTI_AZ) for RabbitMQ to remove single-instance risk.

Apply resiliency by design: clients auto-reconnect, retries with backoff, and idempotent processing; test failover, size for node loss, and enforce least privilege with monitoring for defense in depth.

Remediation

CLI

aws mq create-broker --broker-name <example_resource_name> --engine-type RABBITMQ --deployment-mode CLUSTER_MULTI_AZ --host-instance-type mq.m5.large --publicly-accessible --auto-minor-version-upgrade --users '[{"Username":"<example_username>","Password":"<example_password>"}]'

Terraform

# Terraform: create a RabbitMQ broker in cluster (Multi-AZ) mode
resource "aws_mq_broker" "example" {
  broker_name         = "<example_resource_name>"
  engine_type         = "RabbitMQ"         # Critical: RabbitMQ engine
  deployment_mode     = "CLUSTER_MULTI_AZ" # Critical: cluster (Multi-AZ) to pass the check
  host_instance_type  = "mq.m5.large"
  publicly_accessible = true

  user {
    username = "<example_username>"
    password = "<example_password>"
  }
}

NativeIaC

# CloudFormation: create a RabbitMQ broker in cluster (Multi-AZ) mode
Resources:
  ExampleBroker:
    Type: AWS::AmazonMQ::Broker
    Properties:
      BrokerName: "<example_resource_name>"
      EngineType: RABBITMQ            # Critical: ensures the broker is RabbitMQ
      DeploymentMode: CLUSTER_MULTI_AZ # Critical: sets cluster (Multi-AZ) to pass the check
      HostInstanceType: mq.m5.large
      PubliclyAccessible: true
      Users:
        - Username: "<example_username>"
          Password: "<example_password>"

Other

1Open the AWS Console and go to Amazon MQ
2Click Brokers > Create broker
3Select RabbitMQ as the engine
4Set Deployment mode to Cluster (Multi-AZ)
5Enter a broker name, choose an instance type, set Public access as needed, and create one admin user
6Click Create broker
7Migrate applications to the new broker endpoint, then delete the old single-instance broker
8Note: Deployment mode cannot be changed on an existing broker; you must create a new cluster broker.

Check Code

from typing import List

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.mq.mq_client import mq_client
from prowler.providers.aws.services.mq.mq_service import DeploymentMode, EngineType


class mq_broker_cluster_deployment_mode(Check):
    """Ensure MQ RabbitMQ Broker has cluster deployment mode.

    This check will fail if the RabbitMQ Broker does not have cluster deployment mode.
    """

    def execute(self) -> List[Check_Report_AWS]:
        """Execute the check.

        Returns:
            List[Check_Report_AWS]: A list of reports for each RabbitMQ Broker that does not have cluster deployment mode.
        """
        findings = []
        for broker in mq_client.brokers.values():
            if broker.engine_type == EngineType.RABBITMQ:
                report = Check_Report_AWS(metadata=self.metadata(), resource=broker)
                report.status = "FAIL"
                report.status_extended = f"MQ RabbitMQ Broker {broker.name} does not have a cluster deployment mode."
                if broker.deployment_mode == DeploymentMode.CLUSTER_MULTI_AZ:
                    report.status = "PASS"
                    report.status_extended = f"MQ RabbitMQ Broker {broker.name} does have a cluster deployment mode."

                findings.append(report)

        return findings

References