Amazon EC2 Auto Scaling group should cover multiple Availability Zones
Checks that the Auto Scaling group spans at least two Availability Zones, so it can launch instances in another zone when one becomes unavailable. A single-zone group can be deliberate, such as for batch jobs or to avoid charges for traffic between zones.
- service
- AutoScaling
- severity
- Medium
- scope
- evaluated in every region
How to fix it
- Interrupts service: Auto Scaling then rebalances, replacing some instances with ones in the new zone, which get no load balancer traffic until that zone is enabled on the load balancer.
In the console
EC2 → Auto Scaling Groups → the group → Details → Network
- Subnets
- Add a subnet in a second Availability Zone, keeping the current ones
With the AWS CLI
- Overwrites existing settings: The --vpc-zone-identifier list replaces the group's subnets, so list the subnets it uses now as well as the new one.
aws autoscaling update-auto-scaling-group --auto-scaling-group-name <group-name> --vpc-zone-identifier <subnet-id-zone-a>,<subnet-id-zone-b> --region <region>With Terraform
resource "aws_autoscaling_group" "this" {
name = var.asg_name
min_size = var.min_size
max_size = var.max_size
vpc_zone_identifier = [var.subnet_id_zone_a, var.subnet_id_zone_b]
launch_template {
id = aws_launch_template.this.id
version = "$Default"
}
}
See which of your accounts this check is failing on.
Book a live scan