RDS.5: RDS DB instances should use multiple AZs

What does AWS Security Hub RDS.5 check?

RDS.5 checks whether a standalone RDS DB instance is configured with multiple Availability Zones. It reports FAILED for any single-AZ instance. It does not apply to instances that are part of a Multi-AZ DB cluster deployment; that topology is covered by RDS.15.

Why does RDS.5 matter?

By default an RDS instance runs in a single AZ, and that is the only copy. If the AZ has a power, network, or hardware event the database is unreachable until AWS restores it or you rebuild from backup: hours of downtime and potentially lost data. Multi-AZ maintains a synchronous standby in a second AZ and fails over automatically in a minute or two, with no application change. The standby is not readable; it exists purely for durability and failover.

How do I fix RDS.5?

1. Decide which databases warrant Multi-AZ: production and revenue-facing instances almost always do; dev/test usually do not.
2. Enable it with modify-db-instance --multi-az --apply-immediately (the standby builds in the background with no downtime).
3. Record single-AZ exceptions deliberately rather than leaving resilience to chance.
4. Default production instances to Multi-AZ in IaC.

# Fix the highest-impact data stores first: enable Multi-AZ on production databases.
for db in $(aws rds describe-db-instances \
    --query 'DBInstances[?MultiAZ==`false` && DBClusterIdentifier==null].DBInstanceIdentifier' --output text); do
  aws rds modify-db-instance --db-instance-identifier "$db" \
    --multi-az --apply-immediately
  echo "$db: standby being provisioned in a second AZ"
done

# Span a stateless compute fleet across three AZs, then mirror the set on its load balancer.
aws autoscaling update-auto-scaling-group --auto-scaling-group-name web-tier-asg \
  --vpc-zone-identifier "subnet-0aaa1,subnet-0bbb2,subnet-0ccc3"
aws elbv2 set-subnets --load-balancer-arn "$ALB_ARN" \
  --subnets subnet-0aaa1 subnet-0bbb2 subnet-0ccc3