EC2 Auto Scaling group has Capacity Rebalancing enabled

Check ID: autoscaling_group_capacity_rebalance_enabled
Provider: AWS
Service: autoscaling
Severity: MEDIUM
Categories: resilience
Resource type: AwsAutoScalingAutoScalingGroup

What this check verifies

EC2 Auto Scaling groups use Capacity Rebalancing to act on EC2 rebalance recommendations by launching replacement Spot instances and terminating at-risk ones after they are healthy. Assesses whether this proactive replacement behavior is enabled.

Risk

Without Capacity Rebalancing, Spot interruptions can drop targets and reduce capacity, causing timeouts, 5xx spikes, and backlog growth. The two-minute notice is often insufficient, reducing service availability and increasing the chance of cascading failures and slow recovery.

Recommendation

Enable Capacity Rebalancing for ASGs that use Spot. Apply resilience practices:

Prefer price-capacity-optimized allocation
Keep headroom below MaxSize
Use lifecycle hooks to drain/deregister
Design stateless, interruption-tolerant workloads (least privilege and defense-in-depth for dependencies)

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws autoscaling update-auto-scaling-group —auto-scaling-group-name <example_resource_name> —capacity-rebalance

# Terraform: Enable Capacity Rebalancing on an Auto Scaling group
resource "aws_autoscaling_group" "<example_resource_name>" {
  name               = "<example_resource_name>"
  min_size           = 1
  max_size           = 1
  desired_capacity   = 1
  availability_zones = ["<example_az>"]

  launch_template {
    id    = "<example_resource_id>"
    version = "$Latest"
  }

  capacity_rebalance = true  # CRITICAL: Turns on Capacity Rebalancing
}

# CloudFormation: Enable Capacity Rebalancing on an Auto Scaling group
Resources:
  <example_resource_name>:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      MinSize: "1"
      MaxSize: "1"
      AvailabilityZones: ["<example_az>"]
      LaunchTemplate:
        LaunchTemplateName: <example_resource_name>
        Version: "$Default"
      CapacityRebalance: true  # CRITICAL: Enables proactive replacement of at-risk Spot instances

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = autoscaling_group_capacity_rebalance_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

[DEPRECATED] Auto Scaling launch config has no secrets Auto Scaling group uses ELB health checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires