Skip to main content

Spanner Database Should Be Highly Available

More Info:​

Ensure spanner database is highly available in multiple locations

Risk Level​

Low

Address​

Reliability, Security

Compliance Standards​

  • HIPAA
  • HITRUST CSF
  • NIST CSF
  • PCI
  • SOC2

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration of Spanner Database not being highly available on GCP, you can follow the below steps:

  1. Open the GCP Console and navigate to the Spanner instance that needs to be remediated.

  2. Click on the instance name to open the instance details.

  3. Under the "Instance Configuration" section, click on "Edit".

  4. In the "Edit Instance Configuration" window, scroll down to the "High Availability" section.

  5. Select the "Regional" option to enable regional availability for the Spanner instance.

  6. Choose the desired region for the Spanner instance from the drop-down menu.

  7. Click on "Save" to apply the changes.

  8. Once the changes are saved, the Spanner instance will be highly available across the selected region.

Note: Enabling regional availability will increase the cost of the Spanner instance as it will require additional resources to maintain high availability.

Using CLI

To remediate the misconfiguration of Spanner Database not being highly available in GCP using GCP CLI, you can follow the below steps:

  1. Open the Cloud Shell in the GCP console.

  2. Run the following command to check the current configuration of Spanner Database:

    gcloud spanner instances describe [INSTANCE_NAME] --project=[PROJECT_ID]

    Replace [INSTANCE_NAME] with the name of the Spanner Database instance and [PROJECT_ID] with the ID of the GCP project.

  3. Check the value of the availabilityConfig field in the output of the above command. If the value is REGIONAL, then the instance is highly available. If the value is ZONAL, then the instance is not highly available.

  4. To make the instance highly available, run the following command:

    gcloud spanner instances update [INSTANCE_NAME] --project=[PROJECT_ID] --availability-type=REGIONAL

    Replace [INSTANCE_NAME] with the name of the Spanner Database instance and [PROJECT_ID] with the ID of the GCP project.

  5. After running the above command, the instance will be updated to be highly available. You can check the configuration again by running the command in step 2.

Note: Making the instance highly available may incur additional costs.

Using Python

To remediate the misconfiguration of Spanner Database not being highly available in GCP, you can follow these steps using Python:

  1. Check the current configuration of the Spanner Database:
from google.cloud import spanner

# Create a Spanner client object.
spanner_client = spanner.Client()

# Get a reference to the instance.
instance = spanner_client.instance('your-instance-id')

# Get a reference to the database.
database = instance.database('your-database-id')

# Check if the database is highly available.
if database.is_highly_available():
    print('The database is highly available.')
else:
    print('The database is not highly available.')
  1. If the database is not highly available, update the configuration to make it highly available:
from google.cloud import spanner

# Create a Spanner client object.
spanner_client = spanner.Client()

# Get a reference to the instance.
instance = spanner_client.instance('your-instance-id')

# Get a reference to the database.
database = instance.database('your-database-id')

# Update the configuration to make the database highly available.
database.update_ha(enable=True)

# Check if the database is now highly available.
if database.is_highly_available():
    print('The database is now highly available.')
else:
    print('The database is still not highly available.')
  1. Verify that the database is now highly available by checking the database configuration:
from google.cloud import spanner

# Create a Spanner client object.
spanner_client = spanner.Client()

# Get a reference to the instance.
instance = spanner_client.instance('your-instance-id')

# Get a reference to the database.
database = instance.database('your-database-id')

# Check if the database is highly available.
if database.is_highly_available():
    print('The database is highly available.')
else:
    print('The database is not highly available.')

By following these steps, you can remediate the misconfiguration of Spanner Database not being highly available in GCP using Python.

Using Terraform
resource "google_spanner_instance" "HA_SPANNER_INSTANCE" {
  name         = "HA_SPANNER_INSTANCE_NAME"         # Replace with your Spanner instance ID
  display_name = "HA Spanner Instance"              # Replace with a human‑readable name

  # Set this to a multi‑region instance configuration to make the database highly available
  # in multiple locations, e.g.:
  #   "nam3"     (multi‑region North America)
  #   "eur3"     (multi‑region Europe)
  #   "asia1"    (multi‑region Asia)
  instance_config = "MULTI_REGION_INSTANCE_CONFIG"  # Replace with a valid multi‑region config

  # Capacity config; choose one of num_nodes or processing_units
  num_nodes = 1                                     # Or set processing_units instead

  labels = {
    environment = "ENVIRONMENT_LABEL"              # Replace with your label
  }
}

Changing instance_config from a regional to a multi‑region configuration forces replacement of the Spanner instance, which is an outage‑causing, data‑destructive change unless you migrate data separately and cut over.

After updating the Terraform, terraform plan should show the google_spanner_instance with instance_config changing from the current regional value to your chosen multi‑region config, along with a -/+ replacement indicator for that resource.