Back to Checks
gcp

Compute Engine VM instance has On Host Maintenance set to MIGRATE

compute_instance_on_host_maintenance_migrate
Service: computeSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:compute.googleapis.com/Instance

Compute Engine VM instances should have their On Host Maintenance setting configured to MIGRATE for live migration during host maintenance events, ensuring continuous availability without downtime.

Prowler logoProwlerprowler-provider-gcp

Risk

VM instances configured with On Host Maintenance set to TERMINATE will be shut down during host maintenance events, causing service interruptions and unplanned downtime. This can impact application availability and may require manual intervention to restart services.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks compute_instance_on_host_maintenance_migrate

Recommendation

Configure VM instances to use live migration during host maintenance events to ensure continuous availability. This is the recommended setting for production workloads that require high availability.

Remediation

CLI

gcloud compute instances set-scheduling <INSTANCE_NAME> --maintenance-policy=MIGRATE --zone=<ZONE>

Terraform

# Example: configure On Host Maintenance to MIGRATE for a Compute Engine VM instance
resource "google_compute_instance" "example" {
  name         = var.instance_name
  machine_type = var.machine_type
  zone         = var.zone

  scheduling {
    # Live migrate during host maintenance events
    on_host_maintenance = "MIGRATE"
  }
}

Other

1Open Google Cloud Console and navigate to Compute Engine > VM instances
2Click on the instance name to view details
3Click 'Edit' at the top of the page
4Under 'Availability policies', set 'On host maintenance' to 'Migrate VM instance (recommended)'
5Click 'Save' at the bottom of the page

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.compute.compute_client import compute_client


class compute_instance_on_host_maintenance_migrate(Check):
    """
    Ensure Compute Engine VM instances have On Host Maintenance set to MIGRATE.

    This check evaluates whether VM instances are configured to live migrate during
    host maintenance events, preventing downtime when Google performs maintenance.

    - PASS: VM instance has On Host Maintenance set to MIGRATE.
    - FAIL: VM instance has On Host Maintenance set to TERMINATE.
    """

    def execute(self) -> list[Check_Report_GCP]:
        findings = []
        for instance in compute_client.instances:
            report = Check_Report_GCP(metadata=self.metadata(), resource=instance)

            if instance.on_host_maintenance == "MIGRATE":
                report.status = "PASS"
                report.status_extended = f"VM Instance {instance.name} has On Host Maintenance set to MIGRATE."
            else:
                report.status = "FAIL"
                if instance.preemptible or instance.provisioning_model == "SPOT":
                    vm_type = "preemptible" if instance.preemptible else "Spot"
                    report.status_extended = (
                        f"VM Instance {instance.name} is a {vm_type} VM and has On Host Maintenance set to TERMINATE. "
                        f"{vm_type.capitalize()} VMs cannot use MIGRATE and must always use TERMINATE. "
                        f"If high availability is required, consider using a non-preemptible VM instead."
                    )
                else:
                    report.status_extended = (
                        f"VM Instance {instance.name} has On Host Maintenance set to "
                        f"{instance.on_host_maintenance} instead of MIGRATE."
                    )

            findings.append(report)

        return findings

References