All checks
Low MQ · regional

ActiveMQ brokers should use active/standby deployment mode

Checks that an Amazon MQ for ActiveMQ broker uses active/standby deployment mode: two broker instances in two Availability Zones sharing Amazon EFS storage. When the active instance fails, reboots or is under maintenance the standby takes over, so clients reconnect within seconds instead of losing the broker and its messages.

service
MQ
severity
Low
scope
evaluated in every region

How to fix it

  • Replaces the resource: A broker's deployment mode is fixed at creation: create an active/standby broker with this one's settings, repoint clients, let this one drain, then delete it.
  • Can break clients: Clients must connect through a failover URL listing both of the new broker's endpoints, or they lose the broker the first time it fails over.

In the console

Amazon MQ → Brokers → Create brokers → Apache ActiveMQ → Select deployment and storage (fixed at creation)

Deployment mode
Active/standby broker
Storage type
Amazon EFS, since Amazon EBS does not support active/standby
Subnets
Two subnets in different Availability Zones
Configurations
A configuration holding the flagged broker's settings
ActiveMQ Web Console access
The flagged broker's users, recreated, since users do not carry over
CloudWatch logs
Audit selected, which MQ.2 checks

With the AWS CLI

aws mq create-broker --broker-name <new-broker-name> --engine-type ACTIVEMQ --engine-version <engine-version> --deployment-mode ACTIVE_STANDBY_MULTI_AZ --storage-type EFS --host-instance-type <instance-type> --auto-minor-version-upgrade --no-publicly-accessible --subnet-ids <subnet-id-1> <subnet-id-2> --users Username=<username>,Password=<password> --region <region>

With Terraform

resource "aws_mq_broker" "standby" {
  broker_name                = var.broker_name
  engine_type                = "ActiveMQ"
  engine_version             = var.engine_version
  host_instance_type         = var.host_instance_type
  deployment_mode            = "ACTIVE_STANDBY_MULTI_AZ"
  storage_type               = "efs"
  subnet_ids                 = var.subnet_ids
  auto_minor_version_upgrade = true

  user {
    username = var.username
    password = var.password
  }
}

See which of your accounts this check is failing on.

Book a live scan