# Cis AWS Database 3.2

> Ensure to Create The Appropriate Deployment Configuration

- Skill: `cyberstrikeus/cis-aws-database-3-2` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-aws-database-3-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-aws-database-3-2/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-aws-database-3-2

---


# 3.2 Ensure to Create The Appropriate Deployment Configuration (Manual)

## Description

This control is important and helps businesses to choose from two deployment options, either single or multi-AZ deployment. Depending on the business factor and their security needs the organization is then encouraged to make a decision that would benefit them.

## Rationale

Selecting the appropriate deployment configuration ensures high availability, data durability, and minimal downtime based on business requirements.

## Impact

Choosing the wrong deployment configuration could lead to unnecessary downtime, data loss during failures, or excessive costs for over-provisioned infrastructure.

## Audit Procedure

### Using AWS Console

1. Evaluate High Availability Requirements
   - Assess the high availability needs of your application. Consider factors such as uptime requirements, business continuity, and disaster recovery.
   - Determine if your application requires automatic failover, data durability, and minimal downtime during maintenance or outages.

2. Understand RDS Deployment Options
   - Familiarize yourself with the deployment options available on Amazon RDS. These include single-AZ (Availability Zone) and multi-AZ deployments.
   - Understand the differences between these options regarding availability, durability, and cost.

3. Single-AZ Deployment
   - Consider a single-AZ deployment if high availability is not a critical requirement for your application.
   - In a single-AZ deployment, your database runs in a single Availability Zone, providing basic durability and availability.

4. Multi-AZ Deployment
   - Choose a multi-AZ deployment if high availability and automatic failover are crucial for your application.
   - In a multi-AZ deployment, your database is replicated synchronously to a standby replica in a different Availability Zone, providing automatic failover in the event of a primary database failure.
   - Multi-AZ deployments provide enhanced availability and durability, ensuring minimal downtime during maintenance or outages.

5. Evaluate Cost Implications
   - Consider the cost implications of your deployment choice.
   - Multi-AZ deployments incur additional costs than single-AZ deployments due to the replication and standby infrastructure.

6. Make a Deployment Decision
   - Based on your evaluation of high availability requirements, consider the trade-offs between single-AZ and multi-AZ deployments.
   - Choose the appropriate deployment configuration that meets your application's availability, durability, and cost requirements.

7. Configure RDS Deployment
   - Once you have determined the deployment configuration, go to the Amazon RDS console.
   - Create a new database instance or modify an existing one to match your chosen deployment configuration.
   - Follow the prompts and configure the deployment options, selecting the desired AZs and replication settings.
   - Adjust other configuration settings, such as instance type, storage, and backup options, based on your application's needs.

8. Test and Monitor
   - After the deployment is set up, thoroughly test your application's functionality and performance.
   - Monitor the RDS instance and replication status using the Amazon RDS console or CloudWatch metrics.
   - Ensure that the database failover and automatic maintenance operations work as expected.

## Expected Result

The deployment configuration should match the application's high availability and durability requirements. Production databases handling critical workloads should use multi-AZ deployments.

## Remediation

### Using AWS Console

Review the current deployment configuration and modify to multi-AZ if high availability is required. In the Amazon RDS console, select the instance, click Modify, and enable Multi-AZ deployment.

## Default Value

Single-AZ deployment is the default when creating a new RDS instance.

## References

1. https://aws.amazon.com/products/databases/

## CIS Controls

| Controls Version | Control                   | IG 1 | IG 2 | IG 3 |
| ---------------- | ------------------------- | ---- | ---- | ---- |
| v8               | 0.0 Explicitly Not Mapped |      |      |      |
| v7               | 0.0 Explicitly Not Mapped |      |      |      |

## Profile

Level 1 | Manual