Check ID: fsx_windows_file_system_multi_az_enabled
Provider: AWS
Service: fsx
Severity: LOW
Categories: resilience
Resource type: Other

​
What this check verifies

FSx for Windows File Server file systems are evaluated for Multi-AZ deployment, determined when SubnetIds include more than one subnet in different Availability Zones.

​
Risk

Using Single-AZ creates a single point of failure. AZ outages, server failures, or maintenance can cause extended file share downtime, impacting availability. Crash scenarios may leave data inconsistent, threatening integrity, and recovery may rely on backups, increasing RTO/RPO.

​
Recommendation

Prefer MULTI_AZ_1 for production to uphold high availability and avoid AZ-level single points of failure. Apply resilience and defense in depth: design to tolerate AZ loss, capacity-plan for failover, and test failover regularly. If Single-AZ is unavoidable, limit to noncritical or app-replicated workloads and keep frequent, verified backups.

​
Remediation

# Terraform: FSx for Windows File Server configured for Multi-AZ
resource "aws_fsx_windows_file_system" "<example_resource_name>" {
  storage_capacity    = 32
  subnet_ids          = ["<example_subnet_id_1>", "<example_subnet_id_2>"] # CRITICAL: two subnets in different AZs
  throughput_capacity = 8
  deployment_type     = "MULTI_AZ_1"                                      # CRITICAL: enables Multi-AZ deployment
  preferred_subnet_id = "<example_subnet_id_1>"
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = fsx_windows_file_system_multi_az_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks