Skip to main content
compliance · aws

Auto Scaling groups that run without any scaling policy

resource types
1
rule IDs covered
1
severity
medium

What does ZopNight detect here?

ZopNight flags an EC2 Auto Scaling group that has 0 scaling policies, as returned by `autoscaling:DescribePolicies`, unless the group is managed by an ECS capacity provider or has equal minimum and maximum sizes. Without a policy the group holds a fixed capacity, over-provisioned at quiet times and short of instances at peaks.

Signal and threshold

How ZopNight evaluates Auto Scaling groups that run without any scaling policy.
Field Value
Rule IDsRC-ASC-001
Categorycompliance
Severitymedium
Metricnone — pure configuration read
Threshold0 scaling policies
SourceZopNight
Permissions usedautoscaling:DescribeAutoScalingGroups · autoscaling:DescribePolicies

An Auto Scaling group with nothing telling it to scale

An Auto Scaling group keeps a desired number of instances between a minimum and a maximum. It only changes that number when a scaling policy, a scheduled action or a person tells it to. The describe-policies reference lists four policy types: TargetTrackingScaling, StepScaling, SimpleScaling and PredictiveScaling. A group with none of them behaves like a fixed fleet: you pay for peak capacity around the clock, or you run short when traffic rises.

Finding groups with no policy

This loops over every group whose minimum and maximum differ and prints those with no policy:

Terminal window
for g in $(aws autoscaling describe-auto-scaling-groups \
--query "AutoScalingGroups[?MinSize!=MaxSize].AutoScalingGroupName" --output text); do
n=$(aws autoscaling describe-policies --auto-scaling-group-name "$g" \
--query "length(ScalingPolicies)")
[ "$n" = "0" ] && echo "$g"
done

When the finding fires

ZopNight counts the scaling policies attached to each group it discovered. The rule fires only when that count is known and equal to zero, and the group is not stopped. If the count was not collected, nothing is reported.

Two shapes where no policy is correct

Some groups are meant to have no policy, and the rule skips them:

  • ECS capacity provider groups. When ECS manages a group it adds the AmazonECSManaged tag, and with managed scaling it creates and owns the target tracking policy itself; the ECS cluster auto scaling guide warns not to modify it. ZopNight treats a group carrying that marker as managed.
  • Fixed-size groups. When the minimum equals the maximum, the group cannot scale whatever policy it has, so asking for one would be noise.

Both skips apply only when ZopNight has positively seen the marker; missing data never hides a finding.

A capacity-management gap, not a line item

The finding reports $0. The cost effect is real but indirect: a fleet sized for peak wastes money off-peak, and one sized for average fails under load. ZopNight’s remediation payload proposes a target tracking policy so the group can move in both directions.

Adding a target tracking policy

  1. Open the group in the EC2 Auto Scaling console and choose the Automatic scaling tab.
  2. Create a target tracking policy; 70% average CPU is a common starting point. From the CLI: aws autoscaling put-scaling-policy --auto-scaling-group-name GROUP --policy-name cpu70 --policy-type TargetTrackingScaling --target-tracking-configuration '{"PredefinedMetricSpecification":{"PredefinedMetricType":"ASGAverageCPUUtilization"},"TargetValue":70.0}'.
  3. Use step scaling with CloudWatch alarms instead if the workload reacts better to a non-CPU signal.
  4. Watch the group’s activity history to confirm it scales out and back in.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

472 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

472 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·