DocumentDB cluster has Multi-AZ enabled

Check ID: documentdb_cluster_multi_az_enabled
Provider: AWS
Service: documentdb
Severity: MEDIUM
Categories: resilience
Resource type: AwsRdsDbCluster

What this check verifies

Amazon DocumentDB clusters with Multi-AZ (multi_az) indicate deployment of a primary and one or more replicas across Availability Zones.

Risk

Without Multi-AZ, the cluster depends on a single AZ/instance. An AZ or node failure-or maintenance-can stop reads and writes, causing downtime, timeouts, and SLA breaches. Availability degrades, RTO rises, and applications may experience failed or retried transactions until replacement capacity is created.

Recommendation

Enable Multi-AZ for DocumentDB and distribute instances across distinct AZs.

Maintain at least one replica
Set promotion priorities to guide failover
Test failover regularly and use resilient client retries

This builds fault tolerance and preserves service availability.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws docdb create-db-instance —db-instance-identifier <example_resource_id> —db-cluster-identifier <example_resource_id> —db-instance-class <INSTANCE_CLASS> —engine docdb —availability-zone <OTHER_AZ>

# Add a replica to enable Multi-AZ for an existing DocumentDB cluster
resource "aws_docdb_cluster_instance" "<example_resource_name>" {
  cluster_identifier = "<example_resource_id>"  # CRITICAL: adds a new instance to the cluster to achieve Multi-AZ
  instance_class     = "<INSTANCE_CLASS>"
  availability_zone  = "<OTHER_AZ>"             # CRITICAL: different AZ ensures Multi-AZ failover
}

# CloudFormation: add a replica to enable Multi-AZ for an existing DocumentDB cluster
Resources:
  DocDBReplica:
    Type: AWS::DocDB::DBInstance
    Properties:
      DBClusterIdentifier: "<example_resource_id>"  # CRITICAL: adds a new instance to the cluster to achieve Multi-AZ
      DBInstanceClass: "<INSTANCE_CLASS>"
      AvailabilityZone: "<OTHER_AZ>"                # CRITICAL: place in a different AZ to provide Multi-AZ failover

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = documentdb_cluster_multi_az_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

DocumentDB cluster has deletion protection enabled DocumentDB manual cluster snapshot is not shared publicly

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires