AWS Security Hub · FSx
FSx.3: FSx for OpenZFS should be Multi-AZ
Written and reviewed by Emnode · Last reviewed
What does AWS Security Hub FSx.3 check?
FSx.3 evaluates each FSx for OpenZFS file system and fails any that is not configured for Multi-AZ deployment. OpenZFS offers Multi-AZ (HA), Single-AZ (HA), and Single-AZ (non-HA) types, and only Multi-AZ keeps serving infrastructure in a second Availability Zone.
Why does FSx.3 matter?
A Single-AZ file system (HA or not) keeps all of its data and serving infrastructure inside one Availability Zone. AZ outages are rare but real; when one happens, every workload mounting that file system loses access until the zone recovers, with no automatic failover. Multi-AZ removes that single point of failure behind an unchanged endpoint.
How do I fix FSx.3?
- Choose the Multi-AZ deployment type when creating new OpenZFS file systems.
- For an existing Single-AZ system, migrate data into a new Multi-AZ one (backup/restore or replication).
- Budget for the higher monthly cost of a standby file server and cross-AZ replication.
- Default critical workloads to Multi-AZ in your provisioning standards.
Remediation script · bash
# Fix the highest-impact data stores first: enable Multi-AZ on production databases.
for db in $(aws rds describe-db-instances \
--query 'DBInstances[?MultiAZ==`false` && DBClusterIdentifier==null].DBInstanceIdentifier' --output text); do
aws rds modify-db-instance --db-instance-identifier "$db" \
--multi-az --apply-immediately
echo "$db: standby being provisioned in a second AZ"
done
# Span a stateless compute fleet across three AZs, then mirror the set on its load balancer.
aws autoscaling update-auto-scaling-group --auto-scaling-group-name web-tier-asg \
--vpc-zone-identifier "subnet-0aaa1,subnet-0bbb2,subnet-0ccc3"
aws elbv2 set-subnets --load-balancer-arn "$ALB_ARN" \
--subnets subnet-0aaa1 subnet-0bbb2 subnet-0ccc3Full walkthrough (console steps, edge cases and verification) in the lesson Deploy across multiple Availability Zones.
Is FSx.3 a false positive?
The deployment type is fixed at creation: you cannot convert a Single-AZ OpenZFS file system to Multi-AZ in place, so closing the finding means a migration, not a setting change.