Profile Applicability

  • Level 2

Description

Configuring an EC2 Auto Scaling Group to utilize multiple instance types across multiple Availability Zones ensures resilience, cost optimization, and high availability. This configuration allows the Auto Scaling Group to provision instances from different pools, increasing flexibility in case of instance shortages and achieving better fault tolerance.

Rationale

  • Improved Fault Tolerance: Distributes resources across multiple Availability Zones, minimizing the impact of zone-specific outages.

  • Optimized Cost: Enables selection of the most cost-effective instance types using Spot Instances, Savings Plans, or On-Demand pricing.

  • Flexibility: Supports dynamic workloads by provisioning alternative instance types based on availability and demand.

Impact

Pros:

  • Reduces the risk of outages by spreading resources across AZs.

  • Optimizes costs with flexible instance type selections.

  • Improves scaling performance by utilizing multiple instance pools.

Cons:

  • Requires careful selection of compatible instance types and configurations.

  • Potentially increases operational complexity.

Default Value

By default, an Auto Scaling Group may use a single instance type and AZ unless explicitly configured otherwise.

Pre-Requisite

IAM Permissions Required:

  • autoscaling:CreateAutoScalingGroup

  • autoscaling:UpdateAutoScalingGroup

  • autoscaling:DescribeAutoScalingGroups

  • AWS CLI installed and configured.

Remediation

Test Plan:

Using AWS Console:

  1. Sign in to the AWS Management Console.

  2. Navigate to EC2 > Auto Scaling Groups.

  3. Select the Auto Scaling Group to check its configuration.

  4. Verify that the Instance Types field lists multiple instance types.

  5. Confirm that the Auto Scaling Group spans multiple Availability Zones under the Network section.

Using AWS CLI:

  1. Describe the Auto Scaling Group:

    aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names <asg-name>

  2. Verify the AvailabilityZones field lists multiple AZs.

  3. Check the LaunchTemplate or MixedInstancesPolicy configuration for multiple instance types.

Implementation Steps:

Using AWS Console:

  1. Navigate to EC2 > Auto Scaling Groups.

  2. Select the Auto Scaling Group to edit.

  3. Click Edit and update the Instance Types configuration:

    • Enable Multiple Instance Types under the Instance Configuration section.

    • Specify multiple instance types that meet your workload requirements.

  4. Ensure that Subnets span multiple Availability Zones.

  5. Save the updated configuration.

Using AWS CLI:

  1. Update the Auto Scaling Group to use a mixed instances policy:

    aws autoscaling update-auto-scaling-group \
    --auto-scaling-group-name <asg-name> \
    --mixed-instances-policy '{
      "LaunchTemplate": {
        "LaunchTemplateSpecification": {
          "LaunchTemplateId": "<template-id>",
          "Version": "$Latest"
        },
        "Overrides": [
          {"InstanceType": "t2.micro"},
          {"InstanceType": "t3.micro"},
          {"InstanceType": "m5.large"}
        ]
      },
      "InstancesDistribution": {
        "OnDemandPercentageAboveBaseCapacity": 50,
        "SpotAllocationStrategy": "capacity-optimized"
      }
    }'

  1. Verify the updated configuration:

    aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names <asg-name>

Backout Plan

Using AWS Console:

  1. If using multiple instance types and Availability Zones causes issues, sign in to the AWS Management Console.\

  2. Navigate to EC2, then to Auto Scaling Groups.

  3. Select the Auto Scaling Group and go to the Instance Management section.

  4. Revert to using a single instance type and Availability Zone if necessary.

  5. Save the changes and verify that the Auto Scaling Group is now using the previous configuration.

Using AWS CLI:

  1. To revert back to a single instance type and Availability Zone, run:

    aws autoscaling update-auto-scaling-group --auto-scaling-group-name <ASG_NAME> --instance-types <SINGLE_INSTANCE_TYPE> --availability-zones <SINGLE_AZ>

  2. Verify that the Auto Scaling Group is now using a single instance type and Availability Zone:

    aws autoscaling describe-auto-scaling-groups --auto-scaling-group-name <ASG_NAME>

References

CIS Controls

Version

Control ID

Control Description

IG1

IG2

IG3

v8

5.3

Securely Manage Network Infrastructure – Ensure network devices are resilient and fault-tolerant.

v8

13.2

Ensure Secure Network Communication – Implement measures that prevent disruption during network changes.