RDS.15: The RDS or Aurora cluster is single-AZ

What does AWS Security Hub RDS.15 check?

RDS.15 checks whether an RDS DB cluster is configured for multiple Availability Zones. It reports FAILED when every instance member of the cluster sits in a single AZ. It is distinct from RDS.5, which covers classic Multi-AZ on standalone instances.

Why does RDS.15 matter?

Aurora's storage layer is replicated six ways across three AZs automatically, which masks a blind spot: the instances that actually serve queries are ordinary VMs pinned to one AZ. If they all live in the same AZ and that AZ loses power or network, the cluster cannot fail over — there is no healthy reader to promote, so it waits, potentially for hours, until AWS restores the zone. The data survives; the service goes dark.

How do I fix RDS.15?

1. List cluster members and the AZ each instance is pinned to; flag clusters where all members land in one AZ.
2. Add a reader in a different AZ with create-db-cluster-instance --availability-zone, matching the writer's instance class and setting PromotionTier 1.
3. Trigger a controlled failover-db-cluster to the new reader, time the cutover, and record the RTO in the DR runbook.
4. Prevent recurrence with the Config rule rds-cluster-multi-az-enabled and IaC lint requiring at least two AZs per cluster.

# Fix the highest-impact data stores first: enable Multi-AZ on production databases.
for db in $(aws rds describe-db-instances \
    --query 'DBInstances[?MultiAZ==`false` && DBClusterIdentifier==null].DBInstanceIdentifier' --output text); do
  aws rds modify-db-instance --db-instance-identifier "$db" \
    --multi-az --apply-immediately
  echo "$db: standby being provisioned in a second AZ"
done

# Span a stateless compute fleet across three AZs, then mirror the set on its load balancer.
aws autoscaling update-auto-scaling-group --auto-scaling-group-name web-tier-asg \
  --vpc-zone-identifier "subnet-0aaa1,subnet-0bbb2,subnet-0ccc3"
aws elbv2 set-subnets --load-balancer-arn "$ALB_ARN" \
  --subnets subnet-0aaa1 subnet-0bbb2 subnet-0ccc3