Check provider logo

Managed Instance Group has autohealing enabled with a valid health check

compute_instance_group_autohealing_enabled

Severityhigh
Servicecompute
by Prowler
resilience

Managed Instance Groups (MIGs) should have autohealing enabled with a valid health check configured. Autohealing automatically recreates unhealthy instances based on application-level health checks, ensuring continuous availability.

Risk

Without autohealing, MIGs cannot detect application-level failures such as crashes, freezes, or memory issues. Instances experiencing problems remain undetected and unreplaced, leading to service degradation, extended downtime, and requiring manual intervention to detect and replace failed instances.

Run this check with Prowler CLI

prowler gcp --checks compute_instance_group_autohealing_enabled

Run in Prowler Cloud

Recommendation

Enable autohealing on all Managed Instance Groups by configuring a health check that validates application-level health. Set an appropriate initial delay to allow instances time to start before health checks begin.

Remediation

CLI

gcloud compute instance-groups managed update INSTANCE_GROUP_NAME --health-check=HEALTH_CHECK_NAME --initial-delay=300 --zone=ZONE

Terraform
Other
  1. Navigate to Compute Engine > Instance groups
  2. Select the Managed Instance Group
  3. Click 'Edit'
  4. Under 'Autohealing', click 'Add health check'
  5. Select or create a health check
  6. Set an appropriate initial delay (e.g., 300 seconds)
  7. Click 'Save'

Source Code

Resource Type

compute.googleapis.com/InstanceGroupManager

References