Redshift cluster has Multi-AZ enabled

Check ID: redshift_cluster_multi_az_enabled
Provider: AWS
Service: redshift
Severity: MEDIUM
Categories: resilience
Resource type: AwsRedshiftCluster

What this check verifies

Amazon Redshift clusters are evaluated for Multi-AZ deployment on provisioned RA3 clusters, confirming compute spans two Availability Zones and is served via a single endpoint.

Risk

Absent Multi-AZ, a single-AZ cluster is exposed to AZ or node failures, leading to dropped connections, aborted queries, and stalled ETL/BI jobs. This reduces availability, increases RTO, delays analytics, and risks SLA breaches with cascading pipeline backlogs.

Recommendation

Enable Multi-AZ deployments for provisioned RA3 clusters to avoid single-AZ dependency. Align designs to fault tolerance and high availability: provision sufficient capacity, implement client/ETL retries and reconnects, validate failover periodically, and monitor performance and error rates.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws redshift modify-cluster —cluster-identifier <cluster-id> —multi-az

# Enable Multi-AZ on a Redshift cluster
resource "aws_redshift_cluster" "<example_resource_name>" {
  cluster_identifier = "<example_resource_id>"
  multi_az           = true  # Critical: enables Multi-AZ so the check passes
}

# CloudFormation: Enable Multi-AZ on a Redshift cluster
Resources:
  <example_resource_name>:
    Type: AWS::Redshift::Cluster
    Properties:
      ClusterIdentifier: <example_resource_id>
      MultiAZ: true  # Critical: enables Multi-AZ so the check passes

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = redshift_cluster_multi_az_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Redshift cluster is encrypted in transit Redshift cluster does not use the default database name dev

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires