Check ID: neptune_cluster_multi_az
Provider: AWS
Service: neptune
Severity: MEDIUM
Categories: resilience
Resource type: AwsRdsDbCluster

​
What this check verifies

Amazon Neptune DB clusters are evaluated for Multi-AZ deployment by checking whether the cluster has read-replica instances distributed across multiple Availability Zones. A failing result indicates the cluster is deployed in a single AZ and lacks read-replicas that enable automatic promotion and cross-AZ failover.

​
Risk

Single-AZ deployment creates a clear availability single point of failure.
  • Availability: AZ outage or maintenance can cause prolonged downtime until the primary is rebuilt.
  • Integrity/Recovery: Manual recovery increases risk of configuration errors and longer RTOs, impacting operations and compliance.

​
Recommendation

Adopt a high availability deployment model for production Neptune clusters by placing read-replicas in separate Availability Zones to avoid single points of failure. Regularly test automated failover and combine HA with robust backup and recovery practices as part of a defense-in-depth strategy.

​
Remediation

resource "aws_neptune_cluster" "example" {
 cluster_identifier = "<db_cluster_identifier>"
 availability_zones = ["<AZ_1>", "<AZ_2>", "<AZ_3>"]  # Deploy across multiple AZs for high availability
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = neptune_cluster_multi_az. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks