Skip to main content

More Info:

Your RDS clusters should be using Multi-AZ deployment configurations for high availability and automatic failover support fully managed by AWS.

Risk Level

Medium

Address

Reliability

Compliance Standards

  • APRA CPS 234 (Australia)
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • HIPAA
  • HITRUST CSF
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Using Console

To remediate the misconfiguration of not using Multi-AZ Deployment for an AWS RDS instance, follow these steps using the AWS Management Console:
  1. Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/) and log in to your account.
  2. Navigate to RDS Service: Click on the “Services” dropdown menu at the top left corner and select “RDS” under the Database category.
  3. Select the RDS Instance: From the list of RDS instances, select the instance for which you want to enable Multi-AZ Deployment by clicking on its identifier.
  4. Enable Multi-AZ Deployment: In the RDS instance details page, click on the “Instance actions” dropdown menu and select “Modify”.
  5. Modify the Deployment Options: Scroll down to the “Deployment options” section and check the box next to “Enable Multi-AZ deployment”.
  6. Review and Apply Changes: Review the other configuration settings to ensure they are correct. Click on the “Continue” button.
  7. Apply Changes: On the next page, review the summary of changes and click on the “Modify DB Instance” button to apply the changes.
  8. Monitor the Modification: The modification process will start, and you can monitor the progress on the RDS console. Once the modification is complete, the Multi-AZ Deployment will be enabled for your RDS instance.
By following these steps, you have successfully remediated the misconfiguration of not using Multi-AZ Deployment for your AWS RDS instance.

To remediate the misconfiguration of not using Multi-AZ deployment for an AWS RDS instance using AWS CLI, follow these steps:
  1. Open the AWS CLI on your local machine.
  2. Run the following command to modify your RDS instance to enable Multi-AZ deployment:
    Replace YOUR_DB_INSTANCE_IDENTIFIER with the actual identifier of your RDS instance.
  3. Wait for the modification to complete. You can check the status of the modification by running the following command:
  4. Once the modification is complete and the status shows as “available”, the Multi-AZ deployment for your RDS instance has been successfully enabled.
By following these steps, you can remediate the misconfiguration of not using Multi-AZ deployment for an AWS RDS instance using AWS CLI.
To remediate the misconfiguration of not using Multi-AZ deployment for an AWS RDS instance using Python, you can follow these steps:
  1. Import the necessary libraries:
  1. Define the AWS region and the RDS instance identifier:
  1. Create an RDS client using Boto3:
  1. Modify the RDS instance to enable Multi-AZ deployment:
  1. Check the response to ensure the modification was successful:
  1. Run the Python script to enable Multi-AZ deployment for the specified RDS instance.
By following these steps, you can remediate the misconfiguration of not using Multi-AZ deployment for an AWS RDS instance using Python.
Enabling multi_az may cause a brief outage when the change is applied; with apply_immediately = false (the default), this occurs in the next maintenance window, and with apply_immediately = true it happens immediately.Verification: terraform plan should show an in-place update on aws_rds_cluster.THIS_CLUSTER with multi_az changing from false (or unset) to true.

Additional Reading: