ElastiCache Redis replication group has Multi-AZ enabled

Check ID: elasticache_redis_cluster_multi_az_enabled
Provider: AWS
Service: elasticache
Severity: MEDIUM
Categories: resilience
Resource type: Other

What this check verifies

ElastiCache for Redis replication groups have Multi-AZ automatic failover enabled, distributing primary and replicas across distinct Availability Zones

Risk

Without Multi-AZ failover, a node or AZ outage can make Redis endpoints unreachable, reducing availability. Cold-cache rebuilds shift load to databases, risking saturation and cascading timeouts. Recent writes may be lost during failures, impacting integrity.

Recommendation

Enable Multi-AZ with automatic failover (MultiAZ: enabled) on Redis replication groups and place replicas in separate AZs. Use clients that follow primary/reader endpoints, monitor replication lag, and regularly test failover. Pair with snapshots for recovery; this enforces high availability and resilience.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws elasticache modify-replication-group —replication-group-id <example_resource_id> —multi-az-enabled —automatic-failover-enabled —apply-immediately

# Enable Multi-AZ on an ElastiCache Redis replication group
resource "aws_elasticache_replication_group" "<example_resource_name>" {
  replication_group_id  = "<example_resource_id>"
  description           = "<description>"
  engine                = "redis"
  node_type             = "cache.t4g.small"
  number_cache_clusters = 2

  multi_az_enabled           = true  # CRITICAL: Enables Multi-AZ
  automatic_failover_enabled = true  # Required for Multi-AZ failover
}

# CloudFormation: Enable Multi-AZ on an ElastiCache Redis replication group
Resources:
  <example_resource_name>:
    Type: AWS::ElastiCache::ReplicationGroup
    Properties:
      ReplicationGroupDescription: "<description>"
      Engine: redis
      CacheNodeType: cache.t4g.small
      NumCacheClusters: 2
      MultiAZEnabled: true  # CRITICAL: Enables Multi-AZ for the replication group

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elasticache_redis_cluster_multi_az_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

ElastiCache Redis cluster encrypts data in transit ElastiCache Redis cluster encrypts data at rest

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires