Logo of Trend Micro
Use the Conformity Knowledge Base AI to help improve your Cloud Posture

Multi-AZ Auto Scaling Groups

Trend Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 1000 automated best practice checks.

Risk Level: Medium (should be achieved)
Rule ID: ASG-010

Ensure that your Amazon Auto Scaling Groups (ASGs) span across multiple Availability Zones (AZs) within an AWS cloud region in order to improve the availability of your auto-scaled applications.

This rule can help you with the following compliance standards:

  • NIST4

For further details on compliance standards supported by Conformity, see here.

This rule can help you work with the AWS Well-Architected Framework.

This rule resolution is part of the Conformity Security & Compliance tool for AWS.

Reliability

When your Auto Scaling Group (ASG) is deployed within a Multi-AZ environment, if one Availability Zone becomes unhealthy or unavailable, the ASG launches new EC2 instances to a healthy Availability Zone, enhancing the availability and reliability of the auto-scaled application.

Audit

To determine if your Amazon Auto Scaling Groups can deploy EC2 instances within multiple Availability Zones, perform the following actions:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to Amazon EC2 console at https://console.aws.amazon.com/ec2/.

03 In the main navigation panel, under Auto Scaling, choose Auto Scaling Groups.

04 Click on the name (link) of the Auto Scaling Group (ASG) that you want to examine.

05 Select the Details tab to access the ASG resource configuration information.

06 In the Network section, check the Availability Zones configuration attribute. If the Availability Zones attribute has just one value (e.g. us-east-1a), the selected Amazon Auto Scaling Group can launch EC2 instances within an Availability Zone (AZ) only, therefore the ASG can't take advantage of the reliability of geo-redundancy by deploying EC2 instances across multiple AZs.

07 Repeat steps no. 4 – 6 for each Auto Scaling Group available within the current AWS region.

08 Change the AWS cloud region from the navigation bar and repeat the Audit process for other regions.

Using AWS CLI

01 Run describe-auto-scaling-groups command (OSX/Linux/UNIX) to list the name of each Auto Scaling Group (ASG) deployed in the selected AWS region: 

aws autoscaling describe-auto-scaling-groups
  --region us-east-1
  --output table
  --query 'AutoScalingGroups[*].AutoScalingGroupName'

02 The command output should return a table with the requested ASG name(s): 

---------------------------
|DescribeAutoScalingGroups|
+-------------------------+
|  cc-production-web-asg  |
|  cc-internal-data-asg   |
+-------------------------+

03 Run describe-auto-scaling-groups command (OSX/Linux/UNIX) using the name of the Auto Scaling Group (ASG) that you want to examine as the identifier parameter and custom query filters to list the names of the Availability Zones (AZs) configured for selected ASG: 

aws autoscaling describe-auto-scaling-groups
  --region us-east-1
  --auto-scaling-group-names cc-production-web-asg
  --query 'AutoScalingGroups[*].AvailabilityZones[]'

04 The command output should return the requested Availability Zone identifiers (names): 

[
    "us-east-1a"
]

If the describe-auto-scaling-groups command output returns just one value (i.e. one Availability Zone name), as shown in the example above, the selected Amazon Auto Scaling Group can launch EC2 instances within a single Availability Zone only, therefore your ASG auto-scaling configuration is not multi-AZ.

05 Repeat steps no. 3 and 4 for each Auto Scaling Group available in the selected AWS region.

06 Change the AWS cloud region by updating the --region command parameter value and repeat the Audit process for other regions.

Remediation / Resolution

To expand the availability of your auto-scaled application by setting multiple Availability Zones (AZ) for your Auto Scaling Groups (ASGs), perform the following operations:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to Amazon EC2 console at https://console.aws.amazon.com/ec2/v2/.

03 In the main navigation panel, under Auto Scaling, select Auto Scaling Groups.

04 Select the Auto Scaling Group (ASG) that you want to reconfigure.

05 Choose the Details tab to view the ASG resource configuration details.

06 In the Network section choose Edit to access the network configuration settings available for the selected ASG resource.

07 Select two or more Availability Zones (and associated subnets) from the Select Availability Zones and subnets dropdown list to set up a Multi-AZ configuration for the selected Auto Scaling Group (ASG). Once all the Availability Zones (AZs) are selected, choose Update to apply the configuration changes.

08 Repeat steps no. 4 – 7 for each ASG that you want to reconfigure, available within the current AWS region.

09 Change the AWS cloud region from the navigation bar and repeat the Remediation process for other regions.

Using AWS CLI

01 Run update-auto-scaling-group command (OSX/Linux/UNIX) using the name of the Auto Scaling Group (ASG) that you want to reconfigure as the identifier parameter, to set up a Multi-AZ configuration by adding two or more Availability Zones (and associated subnets) to the selected ASG (the command does not produce an output): 

aws autoscaling update-auto-scaling-group
  --region us-east-1
  --auto-scaling-group-name cc-production-asg
  --vpc-zone-identifier subnet-0abcd1234abcd1234,subnet-0abcdabcdabcdabcd,subnet-01234abcd1234abcd

02 Repeat step no. 1 for each ASG that you want to reconfigure, available in the selected AWS region.

03 Change the AWS cloud region by updating the --region command parameter value and perform the Remediation process for other regions.

References

Publication date Sep 18, 2017

Related AutoScaling rules