Compute VM On Host Maintenance is set to MIGRATE

Check ID: compute_instance_on_host_maintenance_migrate
Provider: GCP
Service: compute
Severity: MEDIUM
Categories: resilience
Resource type: compute.googleapis.com/Instance

What this check verifies

Compute Engine VM instances should have their On Host Maintenance setting configured to MIGRATE for live migration during host maintenance events, ensuring continuous availability without downtime.

Risk

VM instances configured with On Host Maintenance set to TERMINATE will be shut down during host maintenance events, causing service interruptions and unplanned downtime. This can impact application availability and may require manual intervention to restart services.

Recommendation

Configure VM instances to use live migration during host maintenance events to ensure continuous availability. This is the recommended setting for production workloads that require high availability.

Remediation

CLI
Terraform
Dashboard steps

gcloud compute instances set-scheduling <INSTANCE_NAME> --maintenance-policy=MIGRATE --zone=<ZONE>

# Example: configure On Host Maintenance to MIGRATE for a Compute Engine VM instance
resource "google_compute_instance" "example" {
  name         = var.instance_name
  machine_type = var.machine_type
  zone         = var.zone

  scheduling {
    # Live migrate during host maintenance events
    on_host_maintenance = "MIGRATE"
  }
}

References

https://cloud.google.com/compute/docs/instances/setting-instance-scheduling-options

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_instance_on_host_maintenance_migrate. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Compute Engine VM instance has IP forwarding disabled VM instance is not configured as preemptible or Spot VM

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires