# Cis AWS Database 5.12

> Ensure ElastiCache is deployed across multiple Availability Zones (AZs)

- Skill: `cyberstrikeus/cis-aws-database-5-12` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-aws-database-5-12`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-aws-database-5-12/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-aws-database-5-12

---


# 5.12 Ensure ElastiCache is deployed across multiple Availability Zones (AZs)

## Description

Deploying Amazon ElastiCache across multiple Availability Zones means configuring the cache cluster nodes (primary and replicas) to be distributed in different AZs within the same AWS region. This multi-AZ deployment improves fault tolerance and availability by mitigating risks associated with failure or degradation in a single Availability Zone. If the primary node or an AZ becomes unavailable, ElastiCache can automatically fail over to a replica in a different AZ, minimizing downtime and data unavailability.

## Rationale

Distributing ElastiCache nodes across multiple AZs protects the caching layer from localized infrastructure failures, such as power outages, networking disruptions, or hardware faults in a single AZ.

## Impact

Enabling multi-AZ deployment for ElastiCache clusters enhances system availability and resiliency, significantly reducing the risk of cache service interruptions due to an AZ failure or node disruption.

## Audit Procedure

### Using AWS CLI

Audit All Replication Groups for Multi-AZ Status:

```bash
aws elasticache describe-replication-groups --query "ReplicationGroups[*].{ID:ReplicationGroupId,MultiAZ:MultiAZ}"
```

This returns true if Multi-AZ with automatic failover is enabled, otherwise false.

## Expected Result

All replication groups show `MultiAZ: enabled`.

## Remediation

### Using AWS CLI

**1. Prerequisites for Enabling Multi-AZ on ElastiCache:**

- VPC with Subnets in Multiple Availability Zones: The VPC associated with your ElastiCache replication group must have at least two subnets in different Availability Zones within the same AWS Region.
- Cache Subnet Group Configuration: The cache subnet group used by the replication group must include multiple subnets spanning the desired AZs to support node placement.
- Replication Group with At Least One Replica: Multi-AZ requires a primary node and at least one read replica that can be deployed in a different AZ to support automatic failover.
- Automatic Failover Enabled: Failover between primary and replicas is automatic with Multi-AZ, so automatic failover must be enabled on the replication group (can be set at creation or modified later).

**2. Modify the Replication Group to Enable Multi-AZ:**

```bash
aws elasticache modify-replication-group \
  --replication-group-id <your-replication-group-id> \
  --multi-az-enabled \
  --apply-immediately
```

- This command enables Multi-AZ with automatic failover for the specified replication group.
- The --apply-immediately flag ensures the change happens without waiting for the next maintenance window. Use with caution in production.

## Default Value

By default, Multi-AZ is not enabled for ElastiCache replication groups.

## References

1. https://aws.amazon.com/products/databases/

## CIS Controls

| Controls Version | Control                                                  | IG 1 | IG 2 | IG 3 |
| ---------------- | -------------------------------------------------------- | ---- | ---- | ---- |
| v8               | 4 Secure Configuration of Enterprise Assets and Software |      |      |      |

## Profile

Level 2 | Manual