Auto Scaling group spans a single Availability Zone
- Severity
- Low
- Service
- Auto Scaling
- Check ID
- ASG_NOT_MULTI_AZ
What this check finds
An Auto Scaling group configured with only one Availability Zone cannot launch replacement capacity elsewhere during an AZ outage, so the workload it backs has no zonal redundancy. Span the group across two or more Availability Zones.
Passing looks like: Auto Scaling group spans multiple Availability Zones.
How to fix it
Add subnets from additional Availability Zones to the Auto Scaling group.
AWS CLI
aws autoscaling update-auto-scaling-group --auto-scaling-group-name NAME --vpc-zone-identifier "SUBNET_AZ_A,SUBNET_AZ_B"
Names in capitals are placeholders for your own resource. Review a command before you run it.
AWS console
EC2 → Auto Scaling Groups → select group → Edit → Network → add subnets in other AZs.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs