Redshift.16: Redshift subnet groups should span multiple AZs

What does AWS Security Hub Redshift.16 check?

Redshift.16 evaluates the cluster subnet group and fails when its subnets all live in a single Availability Zone. A cluster draws its node placement from this named subnet group, so a single-AZ group pins the whole warehouse to one zone.

Why does Redshift.16 matter?

A single-AZ subnet group is a latent resilience gap nobody notices until an AZ has a bad day, when a power event or network partition then leaves no in-region path to keep serving queries. It also blocks the features that depend on multiple zones: you cannot stand up a meaningful Multi-AZ deployment (Redshift.18) on a single-AZ subnet group.

How do I fix Redshift.16?

1. Add subnets from at least two Availability Zones to the cluster subnet group.
2. Ensure those subnets have the routing and capacity the cluster needs.
3. Use the multi-AZ subnet group when building new clusters, and plan migration for existing ones.
4. Default subnet groups to span multiple AZs in your IaC so the gap doesn't recur.

# Fix the highest-impact data stores first: enable Multi-AZ on production databases.
for db in $(aws rds describe-db-instances \
    --query 'DBInstances[?MultiAZ==`false` && DBClusterIdentifier==null].DBInstanceIdentifier' --output text); do
  aws rds modify-db-instance --db-instance-identifier "$db" \
    --multi-az --apply-immediately
  echo "$db: standby being provisioned in a second AZ"
done

# Span a stateless compute fleet across three AZs, then mirror the set on its load balancer.
aws autoscaling update-auto-scaling-group --auto-scaling-group-name web-tier-asg \
  --vpc-zone-identifier "subnet-0aaa1,subnet-0bbb2,subnet-0ccc3"
aws elbv2 set-subnets --load-balancer-arn "$ALB_ARN" \
  --subnets subnet-0aaa1 subnet-0bbb2 subnet-0ccc3