Back to Checks
gcp

Managed Instance Groups span multiple zones for high availability

compute_instance_group_multiple_zones
Service: computeSeverity: low
OfficialBuilt-inVerified
Categories:resilience
Resource Type:compute.googleapis.com/InstanceGroupManager

Managed Instance Groups (MIGs) should be configured for multi-zone deployments to ensure high availability and fault tolerance. A multi-zone MIG distributes instances across multiple zones within a region, protecting applications from zonal failures.

Prowler logoProwlerprowler-provider-gcp

Risk

Running a MIG in a single zone creates a single point of failure. If that zone experiences an outage, all instances in the group become unavailable, resulting in application downtime during zonal failures, no automatic failover to healthy zones, and reduced resilience against infrastructure issues.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks compute_instance_group_multiple_zones

Recommendation

Use regional managed instance groups instead of zonal MIGs to distribute instances across multiple zones. This provides automatic failover and load distribution, ensuring high availability for production workloads.

Remediation

CLI

gcloud compute instance-groups managed create INSTANCE_GROUP_NAME --region=REGION --template=INSTANCE_TEMPLATE --size=TARGET_SIZE --zones=ZONE1,ZONE2,ZONE3

Terraform

# Create a regional MIG that spans multiple zones
resource "google_compute_region_instance_group_manager" "example" {
  name               = "example-mig"
  region             = "us-central1"
  base_instance_name = "example"
  target_size        = 3

  version {
    instance_template = google_compute_instance_template.example.id
  }

  # Distribute instances across multiple zones
  distribution_policy_zones = ["us-central1-a", "us-central1-b", "us-central1-c"]
}

Other

1Navigate to Compute Engine > Instance groups
2Click 'Create instance group'
3Select 'New managed instance group (stateless)'
4For 'Location', select 'Multiple zones'
5Choose the target region and zones
6Configure the instance template and target size
7Click 'Create'

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.compute.compute_client import compute_client


class compute_instance_group_multiple_zones(Check):
    """
    Ensure Managed Instance Groups span multiple zones for high availability.

    This check verifies whether GCP Managed Instance Groups (MIGs) are distributed
    across multiple zones to ensure high availability and fault tolerance.

    - PASS: The MIG spans the minimum required zones (configurable via mig_min_zones).
    - FAIL: The MIG does not meet the minimum zone requirement.
    """

    def execute(self) -> list[Check_Report_GCP]:
        findings = []
        min_zones = compute_client.audit_config.get("mig_min_zones", 2)

        for instance_group in compute_client.instance_groups:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=instance_group,
                location=instance_group.region,
            )

            zone_count = len(instance_group.zones)
            zones_str = ", ".join(instance_group.zones)

            report.status = "PASS"
            if instance_group.is_regional:
                report.status_extended = f"Managed Instance Group {instance_group.name} is a regional MIG spanning {zone_count} zones ({zones_str})."
            else:
                report.status_extended = f"Managed Instance Group {instance_group.name} spans {zone_count} zones ({zones_str})."

            if zone_count < min_zones:
                report.status = "FAIL"
                if instance_group.is_regional:
                    report.status_extended = f"Managed Instance Group {instance_group.name} is a regional MIG but only spans {zone_count} zone(s) ({zones_str}), minimum required is {min_zones}."
                else:
                    report.status_extended = f"Managed Instance Group {instance_group.name} is a zonal MIG running only in {zones_str}, consider converting to a regional MIG for high availability."

            findings.append(report)

        return findings

References