Back to Checks
azure

Virtual Machine Scale Set has at least one VM instance

vm_scaleset_not_empty
Service: vmSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:microsoft.compute/virtualmachinescalesets

Azure VM scale sets with 0 VM instances are identified as empty.

Prowler logoProwlerprowler-provider-azure

Risk

Orphaned scale sets degrade governance and can hide stale autoscale or permissive identities. If reactivated, they may launch VMs from outdated images, exposing vulnerable services and enabling lateral movement, impacting confidentiality and availability. They also create inventory sprawl and unnecessary spend.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks vm_scaleset_not_empty

Recommendation

Decommission empty scale sets or consolidate capacity. Apply resource lifecycle and governance policies to prevent drift; require tagging and owners, review regularly. Manage capacity through IaC, enforce least privilege on scale set identities, and use change control to avoid unintended autoscale activations. If retained temporarily, document purpose and review date.

Remediation

CLI

az vmss scale --resource-group <resource-group> --name <scale-set-name> --new-capacity 1

Terraform

# Patch the scale set to have at least one instance
resource "azapi_update_resource" "<example_resource_name>" {
  type        = "Microsoft.Compute/virtualMachineScaleSets@2024-03-01"
  resource_id = "<example_resource_id>"

  body = jsonencode({
    sku = {
      capacity = 1 # Critical: ensures the scale set has at least one VM instance
    }
  })
}

Other

1In Azure Portal, go to Virtual machine scale sets and select <scale-set-name>
2Under Settings, click Scaling
3Set Instance count to 1
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.vm.vm_client import vm_client


class vm_scaleset_not_empty(Check):
    """
    Ensure that Azure virtual machine scale sets are not empty (i.e., have no VM instances and no load balancer attached).

    This check evaluates whether each VM scale set has zero VM instances and is not associated with any load balancer backend pool.
    - PASS: The scale set has at least one VM instance or is associated with a load balancer backend pool.
    - FAIL: The scale set has no VM instances and is not associated with any load balancer backend pool (i.e., it is empty).
    """

    def execute(self):
        findings = []
        for subscription, scale_sets in vm_client.vm_scale_sets.items():
            subscription_name = vm_client.subscriptions.get(subscription, subscription)
            for scale_set in scale_sets.values():
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=scale_set
                )
                report.subscription = subscription
                if not scale_set.instance_ids:
                    report.status = "FAIL"
                    report.status_extended = f"Scale set '{scale_set.resource_name}' in subscription '{subscription_name} ({subscription})' is empty: no VM instances present."
                else:
                    report.status = "PASS"
                    report.status_extended = f"Scale set '{scale_set.resource_name}' in subscription '{subscription_name} ({subscription})' has {len(scale_set.instance_ids)} VM instances."
                findings.append(report)
        return findings

References