Check ID: mq_broker_active_deployment_mode
Provider: AWS
Service: mq
Severity: LOW
Categories: resilience
Resource type: AwsAmazonMQBroker

​
What this check verifies

ActiveMQ broker deployment mode is configured as active/standby (ACTIVE_STANDBY_MULTI_AZ), indicating a redundant pair operating across Availability Zones

​
Risk

Without active/standby, a single-instance broker becomes a single point of failure, degrading availability and risking message loss or duplication during outages or maintenance. This can stall message flows, grow backlogs, and cause inconsistent processing across dependent services.

​
Recommendation

Adopt active/standby deployment for ActiveMQ brokers to provide multi-AZ resilience. Design clients for failover with retries and idempotent processing, validate recovery through regular failover testing, monitor broker health, and apply least privilege to limit blast radius.

​
Remediation

# Create an ActiveMQ broker in active/standby Multi-AZ
resource "aws_mq_broker" "<example_resource_name>" {
  broker_name         = "<example_resource_name>"
  engine_type         = "ActiveMQ"
  engine_version      = "<example_resource_name>"
  host_instance_type  = "mq.t3.micro"
  publicly_accessible = false
  deployment_mode     = "ACTIVE_STANDBY_MULTI_AZ"  # Critical: enables active/standby Multi-AZ to pass the check

  subnet_ids      = ["<example_resource_id>", "<example_resource_id>"]  # Critical: two subnets in different AZs
  security_groups = ["<example_resource_id>"]

  user {
    username = "<example_resource_name>"
    password = "<example_resource_id>"
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = mq_broker_active_deployment_mode. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks