Back to Checks
aws

RDS cluster has Multi-AZ enabled

rds_cluster_multi_az
Service: rdsSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsRdsDbCluster

RDS DB clusters are assessed for deployment across multiple Availability Zones (Multi-AZ), verifying that redundant instances exist to support automatic failover instead of a single-AZ configuration.

Prowler logoProwlerprowler-provider-aws

Risk

A single-AZ cluster is a single point of failure. AZ outages, instance/storage faults, or maintenance can cause extended downtime, failed transactions, and worse RTO/RPO. Without cross-AZ replicas, recovery may require restores, increasing outage duration and risking service disruption and data consistency impacts.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks rds_cluster_multi_az

Recommendation

Enable Multi-AZ for production DB clusters to ensure cross-AZ redundancy and automatic failover. Choose a model that meets your SLA (one standby or two readable standbys; Aurora spans 3 AZs). Place subnets in distinct AZs, implement connection retries, and regularly test failover to validate RTO/RPO and readiness.

Remediation

Terraform

# Terraform: create an RDS Multi-AZ DB cluster (non-Aurora)
resource "aws_rds_cluster" "<example_resource_name>" {
  cluster_identifier         = "<example_resource_id>"
  engine                     = "mysql"           # CRITICAL: mysql/postgres with the lines below creates a Multi-AZ DB cluster
  db_cluster_instance_class  = "db.r6g.large"    # CRITICAL: makes this a Multi-AZ DB cluster (1 writer + 2 readers across AZs)
  storage_type               = "io1"             # CRITICAL: required for Multi-AZ DB clusters
  allocated_storage          = 100                # CRITICAL: required for Multi-AZ DB clusters
  iops                       = 1000               # CRITICAL: required for Multi-AZ DB clusters
  master_username            = "<USERNAME>"
  master_password            = "<PASSWORD>"
}

NativeIaC

# CloudFormation: create an RDS Multi-AZ DB cluster (non-Aurora)
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBCluster
    Properties:
      Engine: mysql  # CRITICAL: using mysql/postgres with the properties below creates a Multi-AZ DB cluster
      DBClusterInstanceClass: db.r6g.large  # CRITICAL: required to make it a Multi-AZ DB cluster (creates 1 writer + 2 readers across AZs)
      AllocatedStorage: 100  # CRITICAL: required for Multi-AZ DB clusters
      Iops: 1000             # CRITICAL: required for Multi-AZ DB clusters
      StorageType: io1       # CRITICAL: required for Multi-AZ DB clusters
      MasterUsername: <USERNAME>
      MasterUserPassword: <PASSWORD>

Other

1In the AWS console, go to RDS > Databases > Create database
2Engine: select MySQL or PostgreSQL
3Under Availability and durability, select Multi-AZ DB cluster
4Enter DB cluster identifier and master credentials
5Choose a DB instance class and create the database
6Migrate data to this new Multi-AZ DB cluster and switch your applications to its endpoint

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.rds.rds_client import rds_client


class rds_cluster_multi_az(Check):
    def execute(self):
        findings = []
        for db_cluster in rds_client.db_clusters.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=db_cluster)
            report.status = "FAIL"
            report.status_extended = (
                f"RDS Cluster {db_cluster.id} does not have multi-AZ enabled."
            )
            if db_cluster.multi_az:
                report.status = "PASS"
                report.status_extended = (
                    f"RDS Cluster {db_cluster.id} has multi-AZ enabled."
                )

            findings.append(report)

        return findings

References