Instances Should Be Multi AZ
More Info:
Managed instances are regional for availability purposes. Instances in a single zone creates a single point of failure for all systems in the VPC. It is recommended that all instances should be created as Regional to ensure proper failover.Risk Level
LowAddress
Reliability, SecurityCompliance Standards
HIPAA, NIST, HITRUST, SOC2, NISTCSF, PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
In GCP, the equivalent of Multi AZ in AWS is the “Regional Managed Instance Group”. To remediate the misconfiguration of instances not being Multi AZ in GCP, you can follow these steps:
- Open the GCP console and go to the Compute Engine section.
- Click on “Instance groups” in the left-hand menu.
- Click on the name of the instance group that you want to make Multi AZ.
- Click on the “Edit” button at the top of the page.
- In the “Autohealing” section, select “On” for “Enable autohealing”.
- In the “Location” section, select the region where you want the instance group to be Multi AZ.
- In the “Size” section, set the “Number of instances” to the desired number of instances for the Multi AZ group.
- Click on the “Save” button at the bottom of the page.
Using CLI
Using CLI
In GCP, the concept of Multi-AZ is called “High Availability” and can be achieved by using Managed Instance Groups. To remediate the misconfiguration, you can follow these steps:Replace the placeholders in the command with the following values:Replace the [GROUP_NAME] and [HEALTH_CHECK] placeholders with the actual values.
- Open the Cloud Shell from the GCP Console.
- Create a Managed Instance Group using the following command:
- [GROUP_NAME]: Name of the Managed Instance Group you want to create
- [GROUP_SIZE]: Number of instances you want to create in the group
- [INSTANCE_TEMPLATE]: Name of the instance template you want to use to create instances in the group
- [INSTANCE_NAME]: Base name of the instances in the group
- [ZONE]: Zone in which you want to create the instances
- [HEALTH_CHECK]: Name of the health check that will be used to verify the health of the instances
- Once the Managed Instance Group is created, you can configure it to use the Multi-AZ feature by setting the
autohealingPoliciesproperty. Use the following command to set the property:
- Verify that the Managed Instance Group has been configured for High Availability by checking the Instance Group details in the GCP Console.
Using Python
Using Python
In GCP, the equivalent of Multi-AZ is called “Regionalization”. To remediate the misconfiguration of instances not being multi-AZ, you can use the following steps:Replace Replace
- Identify the instances that are not regionalized. You can use the following Python code to get a list of all the instances that are not regionalized:
[PROJECT_ID] and [ZONE] with your GCP project ID and the zone in which your instances are running.- For each instance that is not regionalized, create a new instance in a regionalized zone and migrate the data.
[PROJECT_ID], [ZONE] and [REGION] with your GCP project ID, the zone in which your instances are running, and the region to which you want to regionalize your instances.Note that this code will create a new instance in the specified region, migrate the data from the old instance to the new instance, and then delete the old instance. You should test this code thoroughly in a non-production environment before running it in production.