Check ID: vpc_subnet_different_az
Provider: AWS
Service: vpc
Severity: MEDIUM
Categories: resilience
Resource type: AwsEc2Subnet

​
What this check verifies

VPCs are assessed for subnets spread across multiple Availability Zones. The finding distinguishes VPCs with subnets confined to a single AZ or with no subnets from those with subnets in 2+ distinct AZs.

​
Risk

Single-AZ subnet layouts create a single point of failure, leading to service downtime during AZ outages, maintenance, or capacity events. Lack of zonal redundancy constrains load balancing and egress design, reduces fault isolation, and undermines availability and recovery objectives.

​
Recommendation

Distribute subnets across 2+ Availability Zones and deploy workloads in separate AZs for high availability. Mirror network tiers per AZ, align routing and egress per AZ, and enforce multi-AZ layouts with IaC and policy guardrails. Regularly test failover to validate resilience.

​
Remediation

# Create two subnets in different AZs so the VPC spans multiple Availability Zones
resource "aws_subnet" "subnet_a" {
  vpc_id            = "<example_resource_id>"
  cidr_block        = "10.0.0.0/24"
  availability_zone = "<example_az_1>" # Critical: first AZ
}

resource "aws_subnet" "subnet_b" {
  vpc_id            = "<example_resource_id>"
  cidr_block        = "10.0.1.0/24"
  availability_zone = "<example_az_2>" # Critical: second AZ; ensures subnets in more than one AZ
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = vpc_subnet_different_az. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks