Back to Checks
aws

Neptune cluster has Multi-AZ enabled

neptune_cluster_multi_az
Service: neptuneSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsRdsDbCluster

Amazon Neptune DB clusters are evaluated for Multi-AZ deployment by checking whether the cluster has read-replica instances distributed across multiple Availability Zones.

A failing result indicates the cluster is deployed in a single AZ and lacks read-replicas that enable automatic promotion and cross-AZ failover.

Prowler logoProwlerprowler-provider-aws

Risk

Single-AZ deployment creates a clear availability single point of failure.

  • Availability: AZ outage or maintenance can cause prolonged downtime until the primary is rebuilt.
  • Integrity/Recovery: Manual recovery increases risk of configuration errors and longer RTOs, impacting operations and compliance.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks neptune_cluster_multi_az

Recommendation

Adopt a high availability deployment model for production Neptune clusters by placing read-replicas in separate Availability Zones to avoid single points of failure.

Regularly test automated failover and combine HA with robust backup and recovery practices as part of a defense-in-depth strategy.

Remediation

Terraform

resource "aws_neptune_cluster" "example" {
 cluster_identifier = "<db_cluster_identifier>"
 availability_zones = ["<AZ_1>", "<AZ_2>", "<AZ_3>"]  # Deploy across multiple AZs for high availability
}

NativeIaC

Resources:
 NeptuneCluster:
 Type: AWS::Neptune::DBCluster
 Properties:
 DBClusterIdentifier: "<DB_CLUSTER_IDENTIFIER>"
 # Deploy across multiple AZs for high availability and failover
 AvailabilityZones:
 - "<AZ_1>"
 - "<AZ_2>"
 - "<AZ_3>"

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.neptune.neptune_client import neptune_client


class neptune_cluster_multi_az(Check):
    def execute(self):
        findings = []
        for cluster in neptune_client.clusters.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.resource_id = cluster.name
            report.status = "FAIL"
            report.status_extended = (
                f"Neptune Cluster {cluster.name} does not have Multi-AZ enabled."
            )
            if cluster.multi_az:
                report.status = "PASS"
                report.status_extended = (
                    f"Neptune Cluster {cluster.name} has Multi-AZ enabled."
                )

            findings.append(report)

        return findings

References