Enable Multi-AZ for RDS Instances

Risk level: Medium (should be achieved)

Rule ID: RDS-01

Enable Multi-AZ deployment configurations on your RDS Instances for high availability and automatic failover support , fully managed by AWS.

Amazon RDS Multi-AZ deployments provide enhanced availability for databases within a single region. In the event of a planned or unplanned outage of your DB instance, Amazon RDS automatically switches to a standby replica in another Availability Zone if you have enabled Multi-AZ.

This rule can help you with the following compliance standards:

  • NIST 800-53 (Rev. 4)

Audit

To determine if your RDS instance are using Multi-AZ configuration, perform the following:

Using AWS Console

  1. Log in to the AWS Management Console.
  2. Navigate to the RDS dashboard at https://console.aws.amazon.com/rds/.
  3. In the navigation panel, under RDS Dashboard, click DB Instances.
  4. Select the RDS Instance that you want to examine.
  5. Click the Configuration tab from all tabs.
  6. Under the Availability  section, search for the Multi-AZ status:

If the current value is set to No, then Multi-AZ feature is not enabled.

A value of No means that the selected RDS instance is not deployed in multiple Availability Zones.

7. Steps No. 4 – 6 can be repeated for all RDS instances that you may have in this or any other region.

 

 

Using AWS CLI

1. Run describe-db-clusters command (OSX/Linux/UNIX) to list all RDS database instance names, available in the selected AWS region:

aws rds describe-db-instances 
--region ap-south-1   
--query 'DBInstances[?DBInstanceStatus==`available`].[DBInstanceIdentifier]' 
--output table

 

2. The command output should return each database instance identifier:

 

3. Run again describe-db-instance command (OSX/Linux/UNIX) using the RDS instance identifier returned earlier to determine the selected instance Multi-AZ configuration status:

aws rds describe-db-instances 
--region ap-south-1    
--db-instance-identifier database-1  
--query 'DBInstances[?DBInstanceStatus==`available`].[MultiAZ]'    
--output table

 

4. The command output should return the Multi-AZ feature current status (true for enabled, false for disabled):

Remediation / Resolution

To update your RDS instance configuration and enable Multi-AZ deployment, perform the following:

Using AWS Console

  1. Log in to the AWS Management Console.
  2. Navigate to the RDS dashboard at https://console.aws.amazon.com/rds/.
  3. In the navigation panel, under RDS Dashboard, click DB instances.
  4. Select the RDS instance for which you want to enable Multi-AZ
  5. Click Modify from the top menu.

1. After clicking the “Modify” button on the screen shown above, you will see options to Enable Multi-AZ deployment. Simply select Create a standby instance (recommended for production usage), as shown in the photo below. and click on continue

2. Select the appropriate option based on the schedule you want to choose:

3. As soon as you click on OK, the DB Instance status will move to Modifying. It generally takes some time to update the instance. Please wait for the “status” to change to “Available” and the “Multi-AZ” column to “Yes“, which means now the instance is available in multiple availability zones.

The steps can be repeated for each RDS instance available in the current region. Change the AWS region from the navigation bar to repeat the process for other regions.

Using AWS CLI

1. Run describe-db-instance command (OSX/Linux/UNIX) to list all RDS instance names, available in the selected AWS region:

aws rds describe-db-instances 
--region ap-south-1   
--query 'DBInstances[?DBInstanceStatus==`available`].[DBInstanceIdentifier]' 
--output table

The command should return each database instance identifier:

2. Run modify-db-instance command (OSX/Linux/UNIX) to modify the selected RDS instance configuration. The following command example enables Multi-AZ deployment for an RDS instance named database-1. The configuration change is asynchronously applied as soon as possible:

aws rds modify-db-instance 
--db-instance-identifier database-1 
--multi-az 
--apply-immediately 
--output table

3. Run describe-db-instance command (OSX/Linux/UNIX) using the RDS instance identifier to check if the Multi-AZ feature has been successfully enabled:

aws rds describe-db-instances 
--region ap-south-1     
--db-instance-identifier database-1  
--query 'DBInstances[*].[MultiAZ]'    
--output table

4. The command output should show the current status:

Steps can be repeated for other AWS regions. Change the AWS region by using the --region filter to repeat the process for other regions.

Still Need Help?

Come see why we are the #1 cloud management platform and why companies like Uber, Dickey’s BBQ Pit and Norwegian Cruise Line trust nOps to manage their cloud.