Back to Checks
gcp

Managed Instance Group is attached to a load balancer

compute_instance_group_load_balancer_attached
Service: computeSeverity: low
OfficialBuilt-inVerified
Categories:resilience
Resource Type:compute.googleapis.com/InstanceGroupManager

Managed Instance Groups (MIGs) should be attached to load balancers via backend services to enable traffic distribution across instances. Load balancers provide health checking, autoscaling integration, and high availability features that are essential for production workloads.

Prowler logoProwlerprowler-provider-gcp

Risk

Without load balancer attachment, MIGs cannot distribute traffic evenly across instances, which impacts:

  • Application availability - No automatic failover when instances become unhealthy
  • Scalability - Autoscaling benefits are limited without proper traffic distribution
  • Performance - Uneven load distribution can cause hotspots and degraded user experience

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks compute_instance_group_load_balancer_attached

Recommendation

Attach Managed Instance Groups to load balancers using backend services to enable traffic distribution, health checking, and seamless autoscaling. This ensures high availability and optimal performance for production workloads.

Remediation

CLI

gcloud compute backend-services add-backend BACKEND_SERVICE_NAME --instance-group=INSTANCE_GROUP_NAME --instance-group-zone=ZONE --global

Terraform

resource "google_compute_backend_service" "example" {
  name        = "example-backend-service"
  protocol    = "HTTP"
  port_name   = "http"
  timeout_sec = 30

  # Attach MIG as backend
  backend {
    group = google_compute_instance_group_manager.example.instance_group
  }

  health_checks = [google_compute_health_check.example.id]
}

Other

1Navigate to Network Services > Load balancing
2Create or edit an HTTP(S) load balancer
3Configure the backend service
4Select the target MIG from the instance group dropdown
5Configure port and balancing mode
6Complete the load balancer setup

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.compute.compute_client import compute_client


class compute_instance_group_load_balancer_attached(Check):
    """
    Ensure Managed Instance Groups are attached to load balancers.

    This check verifies whether GCP Managed Instance Groups (MIGs) are configured
    as backends for load balancers through backend services. MIGs without load
    balancer attachments cannot distribute traffic evenly across instances.

    - PASS: The MIG is attached to a load balancer via a backend service.
    - FAIL: The MIG is not attached to any load balancer.
    """

    def execute(self) -> list[Check_Report_GCP]:
        findings = []

        for instance_group in compute_client.instance_groups:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=instance_group,
                location=instance_group.region,
            )

            if instance_group.load_balanced:
                report.status = "PASS"
                report.status_extended = f"Managed Instance Group {instance_group.name} is attached to a load balancer."
            else:
                report.status = "FAIL"
                report.status_extended = f"Managed Instance Group {instance_group.name} is not attached to any load balancer."

            findings.append(report)

        return findings

References