DMS replication instance has Multi-AZ enabled

Check ID: dms_instance_multi_az_enabled
Provider: AWS
Service: dms
Severity: MEDIUM
Categories: resilience
Resource type: AwsDmsReplicationInstance

What this check verifies

AWS DMS replication instances are evaluated for Multi-AZ configuration. Instances with multi_az enabled are treated as having a cross-AZ standby; those without it are identified as single-AZ.

Risk

Without Multi-AZ, a single-AZ failure or maintenance event can halt migrations, causing extended downtime (availability) and replication gaps or rollbacks (integrity). Tasks may stall, increase cutover risk, and require manual recovery when the replication instance is unavailable.

Recommendation

Enable Multi-AZ (set multi_az to true) on DMS replication instances that handle production or time-sensitive migrations to ensure redundancy and automatic failover. Apply HA principles: distribute across AZs, test failover, monitor health, and plan maintenance to minimize impact.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws dms modify-replication-instance —replication-instance-arn arn:aws:dms:<REGION>:<ACCOUNT_ID>:rep:<REPLICATION_ID> —multi-az —apply-immediately

# Enable Multi-AZ on a DMS replication instance
resource "aws_dms_replication_instance" "<example_resource_name>" {
  replication_instance_id   = "<example_resource_name>"
  replication_instance_class = "dms.t3.micro"
  multi_az                  = true  # Critical: enables Multi-AZ to pass the check
}

# CloudFormation: enable Multi-AZ on a DMS replication instance
Resources:
  <example_resource_name>:
    Type: AWS::DMS::ReplicationInstance
    Properties:
      ReplicationInstanceClass: dms.t3.micro
      MultiAZ: true  # Critical: enables Multi-AZ to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = dms_instance_multi_az_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

DMS replication instance auto-upgrades minor versions DMS replication instance is not Internet-exposed

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires