Managed Instance Group has autohealing with a health check

Check ID: compute_instance_group_autohealing_enabled
Provider: GCP
Service: compute
Severity: HIGH
Categories: resilience
Resource type: compute.googleapis.com/InstanceGroupManager

What this check verifies

Managed Instance Groups (MIGs) should have autohealing enabled with a valid health check configured. Autohealing automatically recreates unhealthy instances based on application-level health checks, ensuring continuous availability.

Risk

Without autohealing, MIGs cannot detect application-level failures such as crashes, freezes, or memory issues. Instances experiencing problems remain undetected and unreplaced, leading to service degradation, extended downtime, and requiring manual intervention to detect and replace failed instances.

Recommendation

Enable autohealing on all Managed Instance Groups by configuring a health check that validates application-level health. Set an appropriate initial delay to allow instances time to start before health checks begin.

Remediation

CLI
Terraform
Dashboard steps

gcloud compute instance-groups managed update INSTANCE_GROUP_NAME --health-check=HEALTH_CHECK_NAME --initial-delay=300 --zone=ZONE

resource "google_compute_instance_group_manager" "example" {
  name               = "example-mig"
  base_instance_name = "example"
  zone               = "us-central1-a"
  target_size        = 2

  version {
    instance_template = google_compute_instance_template.example.id
  }

  # Enable autohealing with health check
  auto_healing_policies {
    health_check      = google_compute_health_check.example.id
    initial_delay_sec = 300
  }
}

resource "google_compute_health_check" "example" {
  name               = "example-health-check"
  check_interval_sec = 10
  timeout_sec        = 5

  http_health_check {
    port = 80
  }
}

References

https://cloud.google.com/compute/docs/instance-groups/autohealing-instances-in-migs

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_instance_group_autohealing_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

VM instance disks use Customer-Supplied Encryption Keys Managed Instance Group is attached to a load balancer

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires