Auto Scaling group uses multiple Availability Zones

Check ID: autoscaling_group_multiple_az
Provider: AWS
Service: autoscaling
Severity: MEDIUM
Categories: resilience
Resource type: AwsAutoScalingAutoScalingGroup

What this check verifies

EC2 Auto Scaling groups use multiple Availability Zones within a Region, with instances distributed across more than one zone rather than confined to a single zone.

Risk

Relying on a single zone concentrates failure risk and harms availability. An AZ outage or capacity shortfall can block replacements and scaling, causing downtime, dropped traffic, and a wider blast radius. Recovery can lag because workloads can’t shift to healthy zones.

Recommendation

Distribute each group across at least two Availability Zones to design for failure. Use a load balancer to spread traffic and health-based replacement to sustain capacity. Apply resilience and fault isolation principles so service continues during zonal degradation.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws autoscaling update-auto-scaling-group —auto-scaling-group-name <example_resource_name> —vpc-zone-identifier “<subnet_id_az1>,<subnet_id_az2>”

# Terraform: ensure ASG spans multiple AZs
resource "aws_autoscaling_group" "<example_resource_name>" {
  min_size = 1
  max_size = 1

  launch_template {
    id      = "<example_resource_id>"
    version = "$Latest"
  }

  vpc_zone_identifier = [
    "<subnet_id_az1>",
    "<subnet_id_az2>" # CRITICAL: two subnets in different AZs to pass the check
  ]
}

# CloudFormation: ensure ASG spans multiple AZs
Resources:
  <example_resource_name>:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      MinSize: '1'
      MaxSize: '1'
      LaunchTemplate:
        LaunchTemplateId: <example_resource_id>
        Version: '$Latest'
      VPCZoneIdentifier:
        - <subnet_id_az1>
        - <subnet_id_az2>  # CRITICAL: Add a second subnet in a different AZ to ensure multiple AZs

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = autoscaling_group_multiple_az. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Auto Scaling group enforces IMDSv2 or disables IMDS Auto Scaling group spans multiple AZs and instance types

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires