rds: `DatabaseInstance` requires 2 AZs even with `multi_az` set to `False`

[andrewvaughan]

Describe the bug

Creating an RDS DatabaseInstance with multi_az set to False should allow for a single AZ to be used, per the documentation:

multi_az (Optional[bool]) – Specifies if the database instance is a multiple Availability Zone deployment. Default: false

AWS also offers tons of documentation making mention of single-AZ RDS instances: https://aws.amazon.com/blogs/database/best-practices-for-converting-a-single-az-amazon-rds-instance-to-a-multi-az-instance/

However, if you try to launch a DatabaseInstance in a single-AZ VPC, you get an error.

Expected Behavior

Single-AZ VPC should be allowed.

Current Behavior

5:52:57 PM | CREATE_FAILED        | AWS::RDS::DBSubnetGroup                       | espocrmdbSubnetGroup10EE67DE
Resource handler returned message: "The DB subnet group doesn't meet Availability Zone (AZ) coverage requirement. Current AZ coverage: us-east-2a. Add subnets to cover at least 2 AZs. (Service: Rds, Status Code: 400, Request ID: 9bd0977c-7a20-46de-a325-dbda6fe5a16c)" (RequestToken: ed519900-7f39-8b7a-80f1-b11d9f265519, HandlerErrorCode: InvalidRequest)

Reproduction Steps

vpc = ec2.Vpc(
    self,
    "vpc-common",
    max_azs=1,
    ip_addresses=ec2.IpAddresses.cidr("10.0.0.0/16"),
    nat_gateways=1,
    subnet_configuration=[
        ec2.SubnetConfiguration(
            name=f"vpc-common-public",
            subnet_type=ec2.SubnetType.PUBLIC,
            cidr_mask=24,
        ),
        ec2.SubnetConfiguration(
            name=f"vpc-common-private",
            subnet_type=ec2.SubnetType.PRIVATE_WITH_EGRESS,
            cidr_mask=24,
        ),
    ],
)

# ...

db_main = rds.DatabaseInstance(
    self,
    "espocrm-db",
    database_name=self.DATABASE_NAME,
    engine=rds.DatabaseInstanceEngine.maria_db(
        version=rds.MariaDbEngineVersion.VER_10_11_7,
    ),
    port=self.DATABASE_PORT,
    auto_minor_version_upgrade=True,
    credentials=rds.Credentials.from_secret(creds_db),
    instance_type=ec2.InstanceType.of(
        ec2.InstanceClass.BURSTABLE3,
        ec2.InstanceSize.MICRO,
    ),
    security_groups=[security_group],
    multi_az=False,
    removal_policy=RemovalPolicy.RETAIN,
    storage_encrypted=True,
    cloudwatch_logs_exports=["audit", "error", "general", "slowquery"],
    monitoring_interval=aws_cdk.Duration.seconds(60),
    backup_retention=aws_cdk.Duration.days(7),
    vpc=vpc,
)

Possible Solution

Remove the requirement for covering 2 AZs when multi_az is set to False

This seems to have caused confusion in the community even back to the CloudFormation days: https://stackoverflow.com/questions/63974936/db-subnet-group-doesnt-meet-availability-zone-coverage-requirement-please-add

Additional Information/Context

For those of us setting up QA instances, or on bootstrap budgets, we can't always afford failover or multi-AZ. A single AZ DB solution seems to be supported - but the documented method of creating one doesn't seem to work.

CDK CLI Version

2.145.0 (build fdf53ba)

Framework Version

No response

Node.js Version

v22.2.0

OS

macOS

Language

Python

Language Version

3.12.0

Other information

No response

[pahud]

You can deploy an Amazon RDS database in a single Availability Zone by not selecting the "Multi-AZ" option when creating the DB instance. [1]

However, you still need to configure a DB subnet group that contains subnets in at least two different Availability Zones within the same AWS Region. [2]

Even though the RDS instance will only be deployed in a single Availability Zone, having the DB subnet group span multiple AZs provides redundancy and failover capabilities if there is an issue with the primary AZ.

The RDS instance will only actively use one of the Availability Zones in the DB subnet group, but the other AZ(s) serve as standby in case a failover is needed. [3]

With that being said, the subnetGroup created for your DbInstance would still require subnets across multi-AZ as its vpcPlacement.

https://github.com/aws/aws-cdk/blob/665396fa8485ab642c27acf30df85f2b023acde4/packages/aws-cdk-lib/aws-rds/lib/instance.ts#L795-L800

[pahud]

We should improve the document and even check that in the code though.

[andrewvaughan]

You can deploy an Amazon RDS database in a single Availability Zone by not selecting the "Multi-AZ" option when creating the DB instance. [1]

However, you still need to configure a DB subnet group that contains subnets in at least two different Availability Zones within the same AWS Region. [2]

Even though the RDS instance will only be deployed in a single Availability Zone, having the DB subnet group span multiple AZs provides redundancy and failover capabilities if there is an issue with the primary AZ.

The RDS instance will only actively use one of the Availability Zones in the DB subnet group, but the other AZ(s) serve as standby in case a failover is needed. [3]

With that being said, the subnetGroup created for your DbInstance would still require subnets across multi-AZ as its vpcPlacement.

https://github.com/aws/aws-cdk/blob/665396fa8485ab642c27acf30df85f2b023acde4/packages/aws-cdk-lib/aws-rds/lib/instance.ts#L795-L800

Thank you for the great reply.

In our case - we don't really care about HA or redundancy for this use-case and are seeking to reduce costs. Is there no option to create a single-AZ database, then, or is that a pattern enforced by Amazon?

[pahud]

The restriction you mentioned appears to be specific to AWS CloudFormation and not the CDK.

Regarding your question about multiple Availability Zones (AZs), deploying resources across multiple AZs can incur cross-AZ data transfer charges, but these charges are usually minimal, as mentioned in the AWS Data Transfer Pricing documentation. The benefit of high availability by using multiple AZs outweighs the potential cost, as it mitigates the risk of an entire AZ failure, as explained in the AWS Availability Zones documentation. Are you trying to optimize for cost savings by limiting the number of AZs used in your deployment?

[github-actions[bot]]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[aws-cdk-automation]

Comments on closed issues and PRs are hard for our team to see. If you need help, please open a new issue that references this one.