---
title: "Run production in two zones or more · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/networking-and-dns/multiple-zones
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Run production in two zones or more

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- ID: INF-58
- Level: Recommended
- Chapter: [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns)
- Rule: Run every production service and data store in at least two availability zones. Losing one zone must leave the service within its objectives.
- How: A zone is a separate data centre with its own power and network, so a fire or power cut takes out one zone only. Create a subnet in each zone and spread servers or containers across them behind one load balancer. Some managed services copy data across zones by themselves, such as object storage and many serverless databases. Others need a setting, such as a managed database's standby in a second zone. Size each zone so the rest can carry the peak, as [Keep headroom](https://agentwranglers.se/playbook/operations/capacity-and-cost/headroom) says. Drill the database side as [Test what a failover loses](https://agentwranglers.se/playbook/data/backups-and-recovery/failover) does. A second region is a separate decision, made from the [recovery targets](https://agentwranglers.se/playbook/operations/disaster-recovery/recovery-targets).
- Check: A script lists every production load balancer target group, database and cache. Each has healthy members in two zones or more. In a staging drill, traffic is moved away from one zone, and the error rate stays within its objective.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Terraform example

```hcl
resource "aws_db_instance" "orders" {
  identifier     = "orders"
  engine         = "postgres"
  instance_class = "db.t4g.medium"
  multi_az       = true
}

resource "aws_autoscaling_group" "web" {
  name                = "web"
  min_size            = 2
  max_size            = 6
  vpc_zone_identifier = [aws_subnet.private_a.id, aws_subnet.private_b.id]
}
```

### Shell example

```sh
# Fails when a production database has no standby in a second zone.
aws rds describe-db-instances --query 'DBInstances[?MultiAZ==`false`].DBInstanceIdentifier' --output text
```

## Sources

- [AWS Well-Architected REL10-BP01 Deploy the workload to multiple locations](https://docs.aws.amazon.com/wellarchitected/latest/reliability-pillar/rel_fault_isolation_multiaz_region_system.html)

## Related rules

- [Keep headroom](https://agentwranglers.se/playbook/operations/capacity-and-cost/headroom) in Operations
- [Test what a failover loses](https://agentwranglers.se/playbook/data/backups-and-recovery/failover) in Data
- [Set recovery targets](https://agentwranglers.se/playbook/operations/disaster-recovery/recovery-targets) in Operations
- [Make one server fast before you add more](https://agentwranglers.se/playbook/scaling/measure-before-you-scale/scale-up-first) in Scaling

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/infrastructure/networking-and-dns/multiple-zones">Agent Wranglers infrastructure playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Authenticate calls between your own services](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/service-to-service-auth)
- [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns)