Back to Checks
aws

RDS instance has Multi-AZ enabled

rds_instance_multi_az
Service: rdsSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsRdsDbInstance

RDS DB instances are evaluated for Multi-AZ configuration, either enabled on the instance or inherited from the associated DB cluster.

Prowler logoProwlerprowler-provider-aws

Risk

Without Multi-AZ, an Availability Zone or instance failure can cause extended downtime and rely on restores, risking loss of recent writes. This degrades availability and may affect integrity, interrupting applications and breaching SLAs.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks rds_instance_multi_az

Recommendation

Apply fault-tolerance and redundancy principles: enable Multi-AZ for production RDS workloads. Choose one standby or two readable standbys based on RTO/RPO and performance needs. Regularly test failover, monitor configuration drift, and allow exceptions only with documented, risk-based approval.

Remediation

CLI

aws rds modify-db-instance --db-instance-identifier <db_instance_id> --multi-az --apply-immediately

Terraform

# Enable Multi-AZ on an RDS DB instance
resource "aws_db_instance" "example" {
  multi_az = true  # Critical: enables Multi-AZ to pass the check
}

NativeIaC

# CloudFormation: enable Multi-AZ on an existing RDS DB instance
Resources:
  RDSInstance:
    Type: AWS::RDS::DBInstance
    Properties:
      MultiAZ: true  # Critical: enables Multi-AZ to pass the check

Other

1Open the AWS Management Console and go to RDS > Databases
2Select the affected DB instance and click Modify
3Under Availability & durability, set Multi-AZ deployment to Enabled (create a standby)
4Check Apply immediately
5Click Continue, then Modify DB instance
6Wait until status is Available and Multi-AZ shows Yes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.rds.rds_client import rds_client


class rds_instance_multi_az(Check):
    def execute(self):
        findings = []
        for db_instance in rds_client.db_instances.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=db_instance)
            # Check if is member of a cluster
            if db_instance.cluster_id:
                if (
                    db_instance.cluster_arn in rds_client.db_clusters
                    and rds_client.db_clusters[db_instance.cluster_arn].multi_az
                ):
                    report.status = "PASS"
                    report.status_extended = f"RDS Instance {db_instance.id} has multi-AZ enabled at cluster {db_instance.cluster_id} level."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"RDS Instance {db_instance.id} does not have multi-AZ enabled at cluster {db_instance.cluster_id} level."
            else:
                if db_instance.multi_az:
                    report.status = "PASS"
                    report.status_extended = (
                        f"RDS Instance {db_instance.id} has multi-AZ enabled."
                    )
                else:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"RDS Instance {db_instance.id} does not have multi-AZ enabled."
                    )

            findings.append(report)

        return findings

References