Use the Conformity Knowledge Base AI to help improve your Cloud Posture

Configure Multiple Instance Types Across Multiple AZs

Trend Micro Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 750 automated best practice checks.

Risk Level: High (not acceptable risk)

Ensure that your Amazon Auto Scaling Groups (ASGs) are configured to use multiple instance types that span across multiple Availability Zones (AZs) within an AWS region in order to enhance the availability of your ASG application.

This rule can help you work with the AWS Well-Architected Framework.

Security
Reliability
Cost
optimisation
Performance
efficiency
Operational
excellence

To follow industry best practices and improve the availability of your application, AWS strongly recommends utilizing multiple EC2 instance types in multiple AZs, as this enables the Auto Scaling Group (ASG) to launch a different instance type if any of your chosen Availability Zones experience insufficient instance capacity. This approach ensures a more robust and resilient setup for your auto-scaled application.


Audit

To determine if your Auto Scaling Groups (ASGs) can deploy multiple instance types across multiple Availability Zones, perform the following operations:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to Amazon EC2 console at https://console.aws.amazon.com/ec2/.

03 In the main navigation panel, under Auto Scaling, select Auto Scaling Groups.

04 Select the Auto Scaling Group (ASG) that you want to examine.

05 Choose the Details tab to view the ASG resource configuration details.

06 Check the instance types listed in the Instance type requirements section. If there are no multiple instance types listed in this section, instead the following message is displayed: "Your Auto Scaling group adheres to the launch template for purchase option and instance type", the selected Auto Scaling Group (ASG) has only one instance type defined, therefore the ASG configuration is not compliant. If there are multiple instance types listed in the Instance type requirements section, continue the Audit process with the next step.

07 Check the Availability Zones attribute value displayed in the Network section. If the Availability Zones attribute has just one value, for example us-east-1a, the selected Auto Scaling Group (ASG) can launch Amazon EC2 instances within one Availability Zone (AZ) only, therefore the ASG can't take advantage of the reliability of geo-redundancy by deploying instances across multiple AZs.

08 Repeat steps no. 4 – 7 for each ASG deployed within the selected AWS region.

09 Change the AWS cloud region from the navigation bar and repeat the Audit process for other regions.

Using AWS CLI

01 Run describe-auto-scaling-groups command (OSX/Linux/UNIX) to list the name of each Auto Scaling Group (ASG) provisioned in the selected AWS region:

aws autoscaling describe-auto-scaling-groups
  --region us-east-1
  --output table
  --query 'AutoScalingGroups[*].AutoScalingGroupName'

02 The command output should return a table with the requested ASG names:

---------------------------
|DescribeAutoScalingGroups|
+-------------------------+
|  cc-web-production-asg  |
|   cc-internal-app-asg   |
+-------------------------+

03 Run describe-auto-scaling-groups command (OSX/Linux/UNIX) using the name of the Auto Scaling Group (ASG) that you want to examine as the identifier parameter and custom query filters to list the EC2 instance type(s) configured for the selected ASG:

aws autoscaling describe-auto-scaling-groups
  --region us-east-1
  --auto-scaling-group-names cc-web-production-asg
  --query 'AutoScalingGroups[*].Instances[].InstanceType'

04 The command output should return the instance type(s) configured for your ASG:

[
	"t3.large"
]

If the describe-auto-scaling-groups command output returns just one instance type, as shown in the example above, the selected Auto Scaling Group (ASG) has only one instance type defined, therefore the ASG configuration is not compliant. If the command output returns two or more instance types, continue the Audit process with the next step.

05 Run describe-auto-scaling-groups command (OSX/Linux/UNIX) using the name of the Auto Scaling Group (ASG) that you want to examine as the identifier parameter, to list the names of the Availability Zones (AZs) configured for selected ASG:

aws autoscaling describe-auto-scaling-groups
  --region us-east-1
  --auto-scaling-group-names cc-web-production-asg
  --query 'AutoScalingGroups[*].AvailabilityZones[]'

06 The command output should return the requested Availability Zone identifiers:

[
	"us-east-1a"
]

If the describe-auto-scaling-groups command output returns just one value (i.e. one Availability Zone name), as shown in the example above, the selected Auto Scaling Group (ASG) can launch Amazon EC2 instances within a single Availability Zone only, therefore the auto-scaling configuration available for ASG is not multi-AZ.

07 Repeat steps no. 3 - 6 for each Auto Scaling Group available in the selected AWS region.

08 Change the AWS cloud region by updating the --region command parameter value and repeat the Audit process for other regions.

Remediation / Resolution

To configure your Auto Scaling Groups (ASGs) to use multiple instance types that span across multiple Availability Zones (AZs), perform the following operations:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to Amazon EC2 console at https://console.aws.amazon.com/ec2/.

03 In the main navigation panel, under Auto Scaling, select Auto Scaling Groups.

04 Select the Auto Scaling Group (ASG) that you want to configure, choose Actions, and select Edit to modify the ASG configuration.

05 For Network, select two or more Availability Zones (and associated subnets) from the Select Availability Zones and subnets dropdown list to set up a Multi-AZ configuration for the selected Auto Scaling Group (ASG).

06 For Instance type requirements, select Override launch template, choose Manually add instance types, and use the Add instance type button to add two or more EC2 instance types to the ASG configuration. Optionally, you can use the Weight box to assign each instance type a relative weight. Enter the number of units that an instance of that type counts toward the desired capacity of the group. This can be useful if the instance types offer different vCPU, memory, storage, or network bandwidth capabilities.

07 For Instance purchase options, specify the percentages of the group to be launched as On-Demand and Spot instances respectively. If your auto-scaled application is stateless, fault tolerant and can handle an instance being interrupted, you can specify a higher percentage of Spot instances. When specifying a percentage for Spot instances, you can configure the Include On-Demand base capacity setting as well. From there, you can define the minimum portion of the ASG's initial capacity that must be fulfilled by On-Demand instances.

08 For Allocation strategies, under On-Demand allocation strategy, choose the allocation strategy to apply to your On-Demand instances when they are launched. When you manually choose your instance types, Prioritized is selected by default.

09 For Spot allocation strategy, choose an allocation strategy. Price capacity optimized (recommended) is selected by default. Lowest price is hidden by default and only appears when you choose Show all strategies.

10 For Capacity rebalance, choose whether to enable or disable the Capacity Rebalancing feature. Enable this feature when your Auto Scaling Group (ASG) must be proactive in trying to replace Spot instances before they are interrupted.

11 Choose Update to apply all the configuration changes.

12 Repeat steps no. 4 – 11 for each ASG that you want to reconfigure, available within the current AWS region.

13 Change the AWS cloud region from the navigation bar and repeat the Remediation process for other regions.

Using AWS CLI

01 Run update-auto-scaling-group command (OSX/Linux/UNIX) using the name of the Auto Scaling Group (ASG) that you want to configure as the identifier parameter, to set up a Multi-AZ configuration by adding two or more Availability Zones (and associated subnets) to the selected ASG (the command does not produce an output):

aws autoscaling update-auto-scaling-group
  --region us-east-1
  --auto-scaling-group-name cc-web-production-asg
  --vpc-zone-identifier subnet-0abcd1234abcd1234,subnet-0abcdabcdabcdabcd,subnet-01234abcd1234abcd

02 Define the mixed instances policy that lets you configure your Auto Scaling Group (ASG) with Spot and On-Demand capacities. Save the policy to a JSON file named asg-config.json:

{
	"AutoScalingGroupName": "cc-web-production-asg",
	"CapacityRebalance": true,
	"MixedInstancesPolicy": {
		"LaunchTemplate": {
			"LaunchTemplateSpecification": {
				"LaunchTemplateName": "web-asg-launch-template",
				"Version": "$Latest"
			},
			"Overrides": [
				{
					"InstanceType": "t3.large"
				},
				{
					"InstanceType": "t3.xlarge"
				}
			]
		},
		"InstancesDistribution": {
			"OnDemandPercentageAboveBaseCapacity": 50,
			"SpotAllocationStrategy": "capacity-optimized"
		}
	},
	"MinSize": 1,
	"MaxSize": 5,
	"DesiredCapacity": 3
}

03 Run update-auto-scaling-group command (OSX/Linux/UNIX) using the name of the Auto Scaling Group (ASG) that you want to configure as the identifier parameter, to apply the mixed instances policy defined at the previous step, i.e. asg-config.json, (the command does not produce an output):

aws autoscaling update-auto-scaling-group 
  --region us-east-1 
  --cli-input-json file://asg-config.json

04 Repeat steps no. 1 - 3 for each ASG that you want to reconfigure, available in the selected AWS region.

05 Change the AWS cloud region by updating the --region command parameter value and perform the Remediation process for other regions.

References

Publication date Aug 31, 2023

Unlock the Remediation Steps


Free 30-day Trial

Automatically audit your configurations with Conformity
and gain access to our cloud security platform.

Confirmity Cloud Platform

No thanks, back to article

You are auditing:

Configure Multiple Instance Types Across Multiple AZs

Risk Level: High