# Ensure Managed Instance Group Has Autohealing Enabled with a Valid Health Check

- Source: https://support.icompaas.com/support/solutions/articles/a_1788888298220959-ensure-managed-instance-group-has-autohealing-enabled-with-a-valid-health-check
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that Managed Instance Groups (MIGs) have autohealing configured with a valid application-level health check, so that unhealthy instances are automatically detected and recreated.

**Rationale**

Without autohealing, a Managed Instance Group only replaces instances that fail infrastructure-level checks (such as the VM being completely down), but it will not detect or recover instances whose application or service has hung, crashed, or become unresponsive while the VM itself remains running. A valid autohealing health check allows the group to detect application-level failures and automatically recreate the affected instance, improving service availability without manual intervention.

**Impact**

-   Automatically detects and remediates application-level failures on individual instances
    
-   Reduces manual operational overhead for maintaining group health
    
-   Requires a properly tuned health check and initial delay to avoid unnecessary instance churn from false positives
    

**Default Value**

By default, Managed Instance Groups do not have autohealing configured; instances are only replaced based on the group's basic infrastructure-level status unless a health check policy is explicitly added.

**Pre-Requisites**

-   An application-level health check resource configured to accurately reflect instance health
    
-   IAM permissions to edit Managed Instance Group configuration (e.g., Compute Instance Admin)
    

**Test Plan**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to Compute Engine > Instance groups and select the group to review.
    
4.  Open the Health checks / Autohealing section of the group's configuration.
    
5.  Verify that a health check is assigned and that it targets the correct port and path for the application.
    
6.  Verify the Initial delay is appropriate for the application's startup time.
    
7.  If no health check is configured, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Navigate to Compute Engine > Health checks and create a health check appropriate to the application (protocol, port, path, and thresholds).
    
3.  Navigate to Compute Engine > Instance groups and select the group to update.
    
4.  Select Edit group.
    
5.  Under Autohealing, select the health check created above and set an appropriate Initial delay.
    
6.  Click Save to apply the configuration.
    
7.  Monitor the group after the change to confirm instances are not being unnecessarily recreated due to an overly strict health check.
    

**Backout Plan**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Navigate to Compute Engine > Instance groups and select the affected group.
    
3.  Select Edit group.
    
4.  Under Autohealing, set the health check back to None (or its previous value).
    
5.  Click Save to apply the change.
    

**Reference**

-   [https://cloud.google.com/compute/docs/instance-groups/autohealing-instances-in-migs](https://cloud.google.com/compute/docs/instance-groups/autohealing-instances-in-migs)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.