MQ RabbitMQ broker has cluster (multi-AZ) deployment mode

Check ID: mq_broker_cluster_deployment_mode
Provider: AWS
Service: mq
Severity: MEDIUM
Categories: resilience
Resource type: AwsAmazonMQBroker

What this check verifies

Amazon MQ RabbitMQ brokers are assessed for cluster deployment mode (CLUSTER_MULTI_AZ) with nodes spread across multiple AZs and shared state. Brokers configured otherwise are identified.

Risk

Without clustered RabbitMQ, the broker is a single point of failure. An instance or AZ outage can halt queues, cause message loss or duplication, and break ordering, reducing availability and integrity of workloads that depend on the broker.

Recommendation

Use cluster deployment (CLUSTER_MULTI_AZ) for RabbitMQ to remove single-instance risk. Apply resiliency by design: clients auto-reconnect, retries with backoff, and idempotent processing; test failover, size for node loss, and enforce least privilege with monitoring for defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws mq create-broker --broker-name <example_resource_name> --engine-type RABBITMQ --deployment-mode CLUSTER_MULTI_AZ --host-instance-type mq.m5.large --publicly-accessible --auto-minor-version-upgrade --users '[{"Username":"<example_username>","Password":"<example_password>"}]'

# Terraform: create a RabbitMQ broker in cluster (Multi-AZ) mode
resource "aws_mq_broker" "example" {
  broker_name         = "<example_resource_name>"
  engine_type         = "RabbitMQ"         # Critical: RabbitMQ engine
  deployment_mode     = "CLUSTER_MULTI_AZ" # Critical: cluster (Multi-AZ) to pass the check
  host_instance_type  = "mq.m5.large"
  publicly_accessible = true

  user {
    username = "<example_username>"
    password = "<example_password>"
  }
}

# CloudFormation: create a RabbitMQ broker in cluster (Multi-AZ) mode
Resources:
  ExampleBroker:
    Type: AWS::AmazonMQ::Broker
    Properties:
      BrokerName: "<example_resource_name>"
      EngineType: RABBITMQ            # Critical: ensures the broker is RabbitMQ
      DeploymentMode: CLUSTER_MULTI_AZ # Critical: sets cluster (Multi-AZ) to pass the check
      HostInstanceType: mq.m5.large
      PubliclyAccessible: true
      Users:
        - Username: "<example_username>"
          Password: "<example_password>"

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = mq_broker_cluster_deployment_mode. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

MQ broker has automated minor version upgrades enabled MQ broker has general and audit logging enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires