Auto Scaling group spans multiple AZs and instance types

Check ID: autoscaling_group_multiple_instance_types
Provider: AWS
Service: autoscaling
Severity: MEDIUM
Categories: resilience
Resource type: AwsAutoScalingAutoScalingGroup

What this check verifies

EC2 Auto Scaling groups are evaluated for using multiple instance types in each Availability Zone and spanning more than one AZ. Groups are identified when every AZ defines at least two instance types; groups with any AZ using a single or no type, or confined to one AZ, are noted.

Risk

Limited to one instance type per AZ or a single AZ, scaling can stall during capacity shortages, hindering failover and degrading availability (timeouts, backlog growth). Costs may spike if only expensive capacity is available. Reduced diversity increases the likelihood of prolonged outages during zonal or market disruptions.

Recommendation

Adopt a mixed instances strategy for resilience:

Use diverse instance families and sizes per AZ
Distribute capacity across multiple AZs
Favor allocation approaches that tolerate spot/on-demand scarcity Apply redundancy and fault tolerance principles and validate scaling policies to avoid single points of capacity failure.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws autoscaling update-auto-scaling-group --auto-scaling-group-name <example_resource_name> --mixed-instances-policy '{"LaunchTemplate":{"LaunchTemplateSpecification":{"LaunchTemplateName":"<example_resource_name>","Version":"$Latest"},"Overrides":[{"InstanceType":"<INSTANCE_TYPE_1>"},{"InstanceType":"<INSTANCE_TYPE_2>"}]}}' --vpc-zone-identifier "<subnet_id_1>,<subnet_id_2>"

# Terraform: Ensure ASG uses multiple instance types across multiple AZs
resource "aws_autoscaling_group" "<example_resource_name>" {
  name               = "<example_resource_name>"
  min_size           = 1
  max_size           = 1
  vpc_zone_identifier = ["<subnet_id_1>", "<subnet_id_2>"] # CRITICAL: Subnets in different AZs

  mixed_instances_policy {
    launch_template {
      launch_template_specification {
        launch_template_name = "<example_resource_name>"
        version              = "$Latest"
      }
      override { instance_type = "<INSTANCE_TYPE_1>" } # CRITICAL: Multiple instance types per AZ
      override { instance_type = "<INSTANCE_TYPE_2>" } # CRITICAL: Multiple instance types per AZ
    }
  }
}

# CloudFormation: Ensure ASG uses multiple instance types across multiple AZs
Resources:
  <example_resource_name>:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      MinSize: "1"
      MaxSize: "1"
      VPCZoneIdentifier:
        - <subnet_id_1>  # CRITICAL: Use subnets in different AZs to span multiple AZs
        - <subnet_id_2>  # CRITICAL: Ensures at least two Availability Zones
      MixedInstancesPolicy:
        LaunchTemplate:
          LaunchTemplateSpecification:
            LaunchTemplateName: <example_resource_name>
            Version: $Latest
          Overrides:
            - InstanceType: <INSTANCE_TYPE_1>  # CRITICAL: Multiple instance types per AZ
            - InstanceType: <INSTANCE_TYPE_2>  # CRITICAL: Multiple instance types per AZ

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = autoscaling_group_multiple_instance_types. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Auto Scaling group uses multiple Availability Zones Amazon EC2 Auto Scaling group uses an EC2 launch template

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires