Back to Checks
gcp

Managed Instance Group has autohealing enabled with a valid health check

compute_instance_group_autohealing_enabled
Service: computeSeverity: high
OfficialBuilt-inVerified
Categories:resilience
Resource Type:compute.googleapis.com/InstanceGroupManager

Managed Instance Groups (MIGs) should have autohealing enabled with a valid health check configured. Autohealing automatically recreates unhealthy instances based on application-level health checks, ensuring continuous availability.

Prowler logoProwlerprowler-provider-gcp

Risk

Without autohealing, MIGs cannot detect application-level failures such as crashes, freezes, or memory issues. Instances experiencing problems remain undetected and unreplaced, leading to service degradation, extended downtime, and requiring manual intervention to detect and replace failed instances.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks compute_instance_group_autohealing_enabled

Recommendation

Enable autohealing on all Managed Instance Groups by configuring a health check that validates application-level health. Set an appropriate initial delay to allow instances time to start before health checks begin.

Remediation

CLI

gcloud compute instance-groups managed update INSTANCE_GROUP_NAME --health-check=HEALTH_CHECK_NAME --initial-delay=300 --zone=ZONE

Terraform

resource "google_compute_instance_group_manager" "example" {
  name               = "example-mig"
  base_instance_name = "example"
  zone               = "us-central1-a"
  target_size        = 2

  version {
    instance_template = google_compute_instance_template.example.id
  }

  # Enable autohealing with health check
  auto_healing_policies {
    health_check      = google_compute_health_check.example.id
    initial_delay_sec = 300
  }
}

resource "google_compute_health_check" "example" {
  name               = "example-health-check"
  check_interval_sec = 10
  timeout_sec        = 5

  http_health_check {
    port = 80
  }
}

Other

1Navigate to Compute Engine > Instance groups
2Select the Managed Instance Group
3Click 'Edit'
4Under 'Autohealing', click 'Add health check'
5Select or create a health check
6Set an appropriate initial delay (e.g., 300 seconds)
7Click 'Save'

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.compute.compute_client import compute_client


class compute_instance_group_autohealing_enabled(Check):
    """
    Ensure Managed Instance Groups have autohealing enabled with a valid health check.

    This check verifies whether GCP Managed Instance Groups (MIGs) have autohealing
    policies configured with valid health check references. Autohealing automatically
    recreates unhealthy instances based on application-level health checks.

    - PASS: The MIG has autohealing enabled with a valid health check configured.
    - FAIL: The MIG has no autohealing policies or is missing a health check reference.
    """

    def execute(self) -> list[Check_Report_GCP]:
        findings = []

        for instance_group in compute_client.instance_groups:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=instance_group,
                location=instance_group.region,
            )

            if not instance_group.auto_healing_policies:
                report.status = "FAIL"
                report.status_extended = f"Managed Instance Group {instance_group.name} does not have autohealing enabled."
            else:
                has_valid_health_check = any(
                    policy.health_check
                    for policy in instance_group.auto_healing_policies
                )

                if has_valid_health_check:
                    health_checks = [
                        policy.health_check
                        for policy in instance_group.auto_healing_policies
                        if policy.health_check
                    ]
                    report.status = "PASS"
                    report.status_extended = f"Managed Instance Group {instance_group.name} has autohealing enabled with health check(s): {', '.join(health_checks)}."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Managed Instance Group {instance_group.name} has autohealing configured but is missing a valid health check reference."

            findings.append(report)

        return findings

References