# 2.2.4 Ensure Multi-AZ deployments are used for enhanced availability in Amazon RDS

- Source: https://support.icompaas.com/support/solutions/articles/62000233081-2-2-4-ensure-multi-az-deployments-are-used-for-enhanced-availability-in-amazon-rds
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 2](https://support.icompaas.com/support/solutions/folders/62000169193)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Profile Applicability:**

**  
Level 1**

## **Description:**

Amazon RDS Multi-AZ deployments ensure high availability and durability by automatically replicating the database to a standby instance in a different Availability Zone (AZ). In case of infrastructure failure, AWS automatically fails over to the standby instance, minimizing downtime.

## Rationale:

-   High Availability: Ensures database availability even during infrastructure failures.
    
-   Automatic Failover: If the primary instance fails, AWS automatically switches to a standby instance.
    
-   Improved Data Durability: Reduces risk of data loss due to storage failures.
    
-   Business Continuity: Ensures mission-critical applications remain operational.
    

## Impact:

-   Multi-AZ deployments increase cost due to the additional standby instance.
    
-   Automatic failover may introduce temporary delays but is faster than manual recovery.
    
-   No manual intervention required in case of a failure
    

## Default Value:

By default, Amazon RDS does not enable Multi-AZ deployment unless explicitly configured.

##  Pre-Requisites:

1.  IAM permissions to modify RDS instances:
    
    -   rds:DescribeDBInstances, rds:ModifyDBInstance
        
2.  AWS CLI installed (for automation)
    
3.  List of all RDS instances in your AWS account
    

## Remediation:

### Test Plan:

## Using AWS Console  
Step 1: Check Multi-AZ Configuration

1.  Log in to the AWS Management Console
    
2.  Navigate to RDS Dashboard → [Amazon RDS Console](https://console.aws.amazon.com/rds/)
    
3.  Click Databases
    

               ![](https://support.icompaas.com/assets/kb/3847bbc90b8b5a11.png)

4.  Select an RDS instance
    

            ![](https://support.icompaas.com/assets/kb/c75138b444b82312.png)

5.  Click Configuration
    

                ![](https://support.icompaas.com/assets/kb/6b26f39765ba90cc.png)

6.  Look for Multi-AZ Deployment
    
    -    If Yes, Multi-AZ is enabled.
        
    -    If No, Multi-AZ is not enabled (instance is at risk).
        

             ![](https://support.icompaas.com/assets/kb/6f5880ee5887c982.png)

## Using AWS CLI

Step 1: List All RDS Instances

aws rds describe-db-instances --query 'DBInstances\[\*\].DBInstanceIdentifier'

Find the RDS instance(s) that need verification.

Step 2: Check If Multi-AZ Is Enabled

aws rds describe-db-instances --db-instance-identifier <db-name> --query 'DBInstances\[\*\].MultiAZ'

Expected Output (If Multi-AZ is enabled):

\[

    true

\]

## Implementation Steps:

## Using AWS Console

Step 1: Modify RDS Multi-AZ Setting

1.  Log in to the AWS Console
    
2.  Navigate to Amazon RDS Console
    
3.  Click Databases → Select the RDS instance
    

              ![](https://support.icompaas.com/assets/kb/a70641229601286b.png)

4.  Click Modify
    

          ![](https://support.icompaas.com/assets/kb/c451da446892020c.png)

5.  Scroll to Availability & Durability
    

          ![](https://support.icompaas.com/assets/kb/50443a3475581ba3.png)

6.  Under Multi-AZ Deployment, select Yes
    
7.  Click Continue
    

                ![](https://support.icompaas.com/assets/kb/864e1c29c5a13958.png)

8.  Choose one:
    
    -   Apply immediately → Changes take effect immediately (may cause downtime).
        
    -   Apply during next maintenance window (Recommended for production).
        

                 ![](https://support.icompaas.com/assets/kb/4af372caaeff5380.png)

9.  Click Modify DB Instance
    

                   ![](https://support.icompaas.com/assets/kb/f7af73aeec34a226.png)

## Using AWS CLI

Step 1: Enable Multi-AZ for a Database Instance

aws rds modify-db-instance --db-instance-identifier <db-name> --multi-az --apply-immediately

This enables Multi-AZ immediately

Step 2: Verify Multi-AZ Deployment

aws rds describe-db-instances --db-instance-identifier <db-name> --query 'DBInstances\[\*\].MultiAZ'

Expected Output (If Multi-AZ is enabled):

\[

    true

\]

## Backout Plan:  
If enabling Multi-AZ causes issues: Disable Multi-AZ:  

aws rds modify-db-instance --db-instance-identifier <db-name> --no-multi-az --apply-immediately

1.  Monitor database performance
    
2.  Restore networking configurations via AWS Console.
    

## References:

-   [Configuring and managing a Multi-AZ deployment for Amazon RDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html)
    
-   [Regions, Availability Zones, and Local Zones](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.RegionsAndAvailabilityZones.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.