cis-aws-database-9-11

name	cis-aws-database-9.11
description	Ensure Neptune DB instances are deployed across multiple Availability Zones (AZs)
category	cis-database
version	2.0.0
author	cyberstrike-official
tags	["cis","aws","database","neptune","graph-database","multi-az","high-availability"]
cis_id	9.11
cis_benchmark	CIS AWS Database Services Benchmark v2.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-database-9.8","cis-aws-database-9.9","cis-aws-database-9.10"]
prerequisites	[]
severity_boost	{}

9.11 Ensure Neptune DB instances are deployed across multiple Availability Zones (AZs) (Manual)

Description

Deploying Amazon Neptune across multiple Availability Zones means configuring the database cluster nodes (primary and replicas) to be distributed in different AZs within the same AWS region. This multi-AZ deployment improves fault tolerance and availability by mitigating risks associated with failure or degradation in a single Availability Zone. If the primary node or an AZ becomes unavailable, Neptune can automatically fail over to a replica in a different AZ, minimizing downtime and data unavailability.

Rationale

Distributing Neptune DBs across multiple AZs protects the database from localized infrastructure failures, such as power outages, networking disruptions, or hardware faults in a single AZ.

Impact

Enabling multi-AZ deployment for Neptune DBs enhances system availability and resiliency, significantly reducing the risk of cache service interruptions due to an AZ failure or node disruption.

Audit Procedure

Using AWS CLI

List Multi-AZ status for all Neptune DB clusters:

aws neptune describe-db-clusters \
  --query "DBClusters[*].{DBClusterIdentifier:DBClusterIdentifier,Engine:Engine,MultiAZ:MultiAZ}"

• MultiAZ: true => Multi-AZ is enabled (compliant).
• MultiAZ: false => Multi-AZ is not enabled (non-compliant).

Expected Result

All Neptune DB clusters should have MultiAZ set to true.

Remediation

Using AWS Console

Enable Multi-AZ on Neptune DB clusters by adding a reader replica in a different Availability Zone:

1. Sign in to the AWS Management Console where the Aurora database cluster you are auditing resides.
2. Navigate to the Neptune Dashboard. You can find this under the Database category.
3. Select the DB cluster where you want to create the reader instance.
4. Choose Actions, and then choose Add reader.
5. Configure the replica DB instance. On the Create replica DB instance page, specify the following options:
   • DB instance class: Choose a DB instance class that matches or aligns with your primary instance (e.g., db.r5.large). This defines the processing and memory requirements for the Neptune replica.
   • Availability zone: Specify a different Availability Zone than the primary DB instance. This is critical for Multi-AZ deployment. The list shows only AZs that are mapped by the DB subnet group for the cluster.
   • Encryption: Enable or disable encryption (recommended: enable if primary has encryption enabled).