DynamoDB Accelerator (DAX) cluster has nodes in multiple AZs

Check ID: dynamodb_accelerator_cluster_multi_az
Provider: AWS
Service: dynamodb
Severity: MEDIUM
Categories: resilience
Resource type: Other

What this check verifies

Amazon DynamoDB Accelerator (DAX) cluster node placement across Availability Zones is evaluated. Clusters with nodes in more than one AZ within the Region are recognized as multi-AZ; clusters whose nodes reside in a single AZ are recognized as single-AZ.

Risk

Without multi-AZ DAX nodes, an AZ outage or primary node failure can render the cache unavailable, harming availability and causing latency spikes and throttling as load shifts to DynamoDB. Loss of caching can drive higher costs and trigger timeout cascades in read-heavy workloads.

Recommendation

Deploy DAX clusters with at least 3 nodes spread across distinct Availability Zones to ensure fault tolerance. Use subnet groups spanning multiple AZs, access via the cluster endpoint, and validate failover regularly. Monitor capacity to avoid single-AZ or single-node dependencies.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws dax increase-replication-factor —cluster-name <example_resource_name> —new-replication-factor 2 —availability-zones <AZ_1> <AZ_2>

resource "aws_dax_cluster" "example" {
  cluster_name       = "<example_resource_name>"
  node_type          = "<NODE_TYPE>"
  replication_factor = 2  # CRITICAL: at least 2 nodes to allow multi-AZ
  iam_role_arn       = "<example_resource_id>"
  subnet_group_name  = "<example_resource_name>"
  availability_zones = ["<AZ_1>", "<AZ_2>"]  # CRITICAL: ensures nodes are in multiple AZs
}

Resources:
  DAXCluster:
    Type: AWS::DAX::Cluster
    Properties:
      ClusterName: <example_resource_name>
      IAMRoleARN: <example_resource_id>
      NodeType: <NODE_TYPE>
      ReplicationFactor: 2  # CRITICAL: at least 2 nodes so nodes can be placed in multiple AZs
      SubnetGroupName: <example_resource_name>
      AvailabilityZones:     # CRITICAL: specify multiple AZs to ensure multi-AZ placement
        - <AZ_1>
        - <AZ_2>

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = dynamodb_accelerator_cluster_multi_az. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

DynamoDB Accelerator (DAX) encrypts data in transit DynamoDB table uses on-demand capacity or auto scaling

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires