# Ensure Auto Scaling Group Uses Multiple Availability Zones

- Source: https://support.icompaas.com/support/solutions/articles/a_1788890021401826-ensure-auto-scaling-group-uses-multiple-availability-zones
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Cloud](https://support.icompaas.com/support/solutions/c_1788889426924716) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1788889470630116)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that EC2 Auto Scaling groups are configured to launch instances across multiple Availability Zones within a Region, rather than being confined to a single Availability Zone.

**Rationale**

An Auto Scaling group confined to a single Availability Zone places all of its capacity at risk of a single zonal outage, power event, or network disruption, which can cause a complete service outage. Spanning multiple Availability Zones allows the group to continue serving traffic, at reduced capacity, if a single zone becomes unavailable, significantly improving the resilience of the workload.

**Impact**

-   Reduces the risk of a complete outage due to a single Availability Zone failure
    
-   Improves overall application resilience and availability
    
-   Requires subnets to be available in multiple zones and application architecture to tolerate cross-AZ operation
    

**Default Value**

There is no fixed default; the set of Availability Zones (via subnets) used by an Auto Scaling group is determined by the subnets specified at group creation, and a group can be created spanning only a single zone if only one subnet is selected.

**Pre-Requisites**

-   Subnets available in at least two Availability Zones within the target VPC
    
-   IAM permissions to update Auto Scaling group settings (autoscaling:UpdateAutoScalingGroup)
    

**Test Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to EC2 > Auto Scaling Groups and select the group to review.
    
3.  Open the Details tab and review the Availability Zones / subnets configured for the group.
    
4.  Verify that at least two Availability Zones (via distinct subnets) are configured.
    
5.  If the group spans only one Availability Zone, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to EC2 > Auto Scaling Groups and select the group to update.
    
3.  On the Details tab, locate the Network section and select Edit.
    
4.  Add subnets from one or more additional Availability Zones to the group's subnet selection.
    
5.  Choose Update to save the change.
    
6.  Verify subsequent scale-out activity launches instances across the newly added zones as expected.
    

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to EC2 > Auto Scaling Groups and select the affected group.
    
3.  On the Details tab, locate the Network section and select Edit.
    
4.  Remove the additional Availability Zone subnets, leaving only the original single zone.
    
5.  Choose Update to save the change.
    

**Reference**

-   [https://docs.aws.amazon.com/autoscaling/ec2/userguide/auto-scaling-benefits.html](https://docs.aws.amazon.com/autoscaling/ec2/userguide/auto-scaling-benefits.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.