ActiveMQ brokers should use active/standby deployment mode
Checks that an Amazon MQ for ActiveMQ broker uses active/standby deployment mode: two broker instances in two Availability Zones sharing Amazon EFS storage. When the active instance fails, reboots or is under maintenance the standby takes over, so clients reconnect within seconds instead of losing the broker and its messages.
- service
- MQ
- severity
- Low
- scope
- evaluated in every region
How to fix it
- Replaces the resource: A broker's deployment mode is fixed at creation: create an active/standby broker with this one's settings, repoint clients, let this one drain, then delete it.
- Can break clients: Clients must connect through a failover URL listing both of the new broker's endpoints, or they lose the broker the first time it fails over.
In the console
Amazon MQ → Brokers → Create brokers → Apache ActiveMQ → Select deployment and storage (fixed at creation)
- Deployment mode
- Active/standby broker
- Storage type
- Amazon EFS, since Amazon EBS does not support active/standby
- Subnets
- Two subnets in different Availability Zones
- Configurations
- A configuration holding the flagged broker's settings
- ActiveMQ Web Console access
- The flagged broker's users, recreated, since users do not carry over
- CloudWatch logs
- Audit selected, which MQ.2 checks
With the AWS CLI
aws mq create-broker --broker-name <new-broker-name> --engine-type ACTIVEMQ --engine-version <engine-version> --deployment-mode ACTIVE_STANDBY_MULTI_AZ --storage-type EFS --host-instance-type <instance-type> --auto-minor-version-upgrade --no-publicly-accessible --subnet-ids <subnet-id-1> <subnet-id-2> --users Username=<username>,Password=<password> --region <region>With Terraform
resource "aws_mq_broker" "standby" {
broker_name = var.broker_name
engine_type = "ActiveMQ"
engine_version = var.engine_version
host_instance_type = var.host_instance_type
deployment_mode = "ACTIVE_STANDBY_MULTI_AZ"
storage_type = "efs"
subnet_ids = var.subnet_ids
auto_minor_version_upgrade = true
user {
username = var.username
password = var.password
}
}
See which of your accounts this check is failing on.
Book a live scan