Managed Instance Groups span multiple zones

Check ID: compute_instance_group_multiple_zones
Provider: GCP
Service: compute
Severity: LOW
Categories: resilience
Resource type: compute.googleapis.com/InstanceGroupManager

What this check verifies

Managed Instance Groups (MIGs) should be configured for multi-zone deployments to ensure high availability and fault tolerance. A multi-zone MIG distributes instances across multiple zones within a region, protecting applications from zonal failures.

Risk

Running a MIG in a single zone creates a single point of failure. If that zone experiences an outage, all instances in the group become unavailable, resulting in application downtime during zonal failures, no automatic failover to healthy zones, and reduced resilience against infrastructure issues.

Recommendation

Use regional managed instance groups instead of zonal MIGs to distribute instances across multiple zones. This provides automatic failover and load distribution, ensuring high availability for production workloads.

Remediation

CLI
Terraform
Dashboard steps

gcloud compute instance-groups managed create INSTANCE_GROUP_NAME --region=REGION --template=INSTANCE_TEMPLATE --size=TARGET_SIZE --zones=ZONE1,ZONE2,ZONE3

# Create a regional MIG that spans multiple zones
resource "google_compute_region_instance_group_manager" "example" {
  name               = "example-mig"
  region             = "us-central1"
  base_instance_name = "example"
  target_size        = 3

  version {
    instance_template = google_compute_instance_template.example.id
  }

  # Distribute instances across multiple zones
  distribution_policy_zones = ["us-central1-a", "us-central1-b", "us-central1-c"]
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_instance_group_multiple_zones. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Managed Instance Group is attached to a load balancer Compute Engine VM instance has IP forwarding disabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires