Check ID: rds_cluster_multi_az
Provider: AWS
Service: rds
Severity: MEDIUM
Categories: resilience
Resource type: AwsRdsDbCluster

​
What this check verifies

RDS DB clusters are assessed for deployment across multiple Availability Zones (Multi-AZ), verifying that redundant instances exist to support automatic failover instead of a single-AZ configuration.

​
Risk

A single-AZ cluster is a single point of failure. AZ outages, instance/storage faults, or maintenance can cause extended downtime, failed transactions, and worse RTO/RPO. Without cross-AZ replicas, recovery may require restores, increasing outage duration and risking service disruption and data consistency impacts.

​
Recommendation

Enable Multi-AZ for production DB clusters to ensure cross-AZ redundancy and automatic failover. Choose a model that meets your SLA (one standby or two readable standbys; Aurora spans 3 AZs). Place subnets in distinct AZs, implement connection retries, and regularly test failover to validate RTO/RPO and readiness.

​
Remediation

# Terraform: create an RDS Multi-AZ DB cluster (non-Aurora)
resource "aws_rds_cluster" "<example_resource_name>" {
  cluster_identifier         = "<example_resource_id>"
  engine                     = "mysql"           # CRITICAL: mysql/postgres with the lines below creates a Multi-AZ DB cluster
  db_cluster_instance_class  = "db.r6g.large"    # CRITICAL: makes this a Multi-AZ DB cluster (1 writer + 2 readers across AZs)
  storage_type               = "io1"             # CRITICAL: required for Multi-AZ DB clusters
  allocated_storage          = 100                # CRITICAL: required for Multi-AZ DB clusters
  iops                       = 1000               # CRITICAL: required for Multi-AZ DB clusters
  master_username            = "<USERNAME>"
  master_password            = "<PASSWORD>"
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_cluster_multi_az. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks