Check provider logo

VPC has subnets in more than one Availability Zone

vpc_subnet_different_az

Severitymedium
Servicevpc
by Prowler
resilience

VPCs are assessed for subnets spread across multiple Availability Zones. The finding distinguishes VPCs with subnets confined to a single AZ or with no subnets from those with subnets in 2+ distinct AZs.

Risk

Single-AZ subnet layouts create a single point of failure, leading to service downtime during AZ outages, maintenance, or capacity events. Lack of zonal redundancy constrains load balancing and egress design, reduces fault isolation, and undermines availability and recovery objectives.

Run this check with Prowler CLI

prowler aws --checks vpc_subnet_different_az

Run in Prowler Cloud

Recommendation

Distribute subnets across 2+ Availability Zones and deploy workloads in separate AZs for high availability. Mirror network tiers per AZ, align routing and egress per AZ, and enforce multi-AZ layouts with IaC and policy guardrails. Regularly test failover to validate resilience.

Remediation

Native IaC
Terraform
Other
  1. In the AWS Console, go to VPC > Subnets
  2. Click Create subnet
  3. Select the target VPC (<example_resource_id>)
  4. Add two subnets with non-overlapping CIDRs in different Availability Zones (e.g., <example_az_1> and <example_az_2>)
  5. Click Create subnet to save

Source Code

Resource Type

AwsEc2Subnet

References