Auto Scaling group uses multiple Availability Zones

autoscaling_group_multiple_az

Service: autoscalingSeverity: medium

OfficialBuilt-inVerified

Categories:resilience

Resource Type:AwsAutoScalingAutoScalingGroup

EC2 Auto Scaling groups use multiple Availability Zones within a Region, with instances distributed across more than one zone rather than confined to a single zone.

Prowler prowler-provider-aws

Risk

Relying on a single zone concentrates failure risk and harms availability. An AZ outage or capacity shortfall can block replacements and scaling, causing downtime, dropped traffic, and a wider blast radius. Recovery can lag because workloads can't shift to healthy zones.

Run this check with Prowler

Run in Prowler Cloud

Run

prowler aws --checks autoscaling_group_multiple_az

Recommendation

Distribute each group across at least two Availability Zones to design for failure. Use a load balancer to spread traffic and health-based replacement to sustain capacity. Apply resilience and fault isolation principles so service continues during zonal degradation.

Remediation

CLI

aws autoscaling update-auto-scaling-group --auto-scaling-group-name <example_resource_name> --vpc-zone-identifier "<subnet_id_az1>,<subnet_id_az2>"

Terraform

# Terraform: ensure ASG spans multiple AZs
resource "aws_autoscaling_group" "<example_resource_name>" {
  min_size = 1
  max_size = 1

  launch_template {
    id      = "<example_resource_id>"
    version = "$Latest"
  }

  vpc_zone_identifier = [
    "<subnet_id_az1>",
    "<subnet_id_az2>" # CRITICAL: two subnets in different AZs to pass the check
  ]
}

NativeIaC

# CloudFormation: ensure ASG spans multiple AZs
Resources:
  <example_resource_name>:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      MinSize: '1'
      MaxSize: '1'
      LaunchTemplate:
        LaunchTemplateId: <example_resource_id>
        Version: '$Latest'
      VPCZoneIdentifier:
        - <subnet_id_az1>
        - <subnet_id_az2>  # CRITICAL: Add a second subnet in a different AZ to ensure multiple AZs

Other

1In the AWS Console, go to EC2 > Auto Scaling Groups

2Select the group and open the Details tab

3Click Network > Edit

4In Subnets, add one more subnet from a different Availability Zone

5Click Update to save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.autoscaling.autoscaling_client import (
    autoscaling_client,
)


class autoscaling_group_multiple_az(Check):
    def execute(self):
        findings = []
        for group in autoscaling_client.groups:
            report = Check_Report_AWS(metadata=self.metadata(), resource=group)

            report.status = "FAIL"
            report.status_extended = (
                f"Autoscaling group {group.name} has only one availability zones."
            )
            if len(group.availability_zones) > 1:
                report.status = "PASS"
                report.status_extended = (
                    f"Autoscaling group {group.name} has multiple availability zones."
                )

            findings.append(report)

        return findings