Autoscaling Fundamentals: Picking the Right Policy Type

Autoscaling is one of those topics where the cloud provider documentation explains every feature in detail and never tells you which one to pick. Target tracking, step scaling, predictive scaling, scheduled scaling, manual scaling, all valid choices, all good for different workloads. The wrong choice silently underprovisions your service or pays for capacity you never need.

This article walks through the four main autoscaling policy types, when each one fits, and the six audit rules ZopNight ships to catch common misconfigurations. It covers AWS ASG, AWS ECS Application Auto Scaling, GCP MIG, and Azure VMSS. The same conceptual choices apply across providers, only the API surface and the parameter names change.

The goal is not to make autoscaling complicated. It is to give you a decision tree that fits real workloads, and to surface the misconfigurations that ZopNight has seen in production audits often enough to bake into rules.

This guide keeps the theory short and spends most of its length on what you can actually do. Every recommendation here is one ZopNight can help you execute, starting from a read-only connection.

Target tracking: the default

Target tracking keeps a metric at a target value. Target tracking is the right default for most production services because it is simple and self-tuning. RC-ASC-006 flags cooldowns under 120 seconds (flapping).

Step scaling: for burst-heavy workloads

Step scaling defines tiered adjustments based on metric deviation. Step scaling reacts faster than target tracking for burst-heavy workloads because larger deviations trigger larger adjustments. The cost is configuration complexity. ZopNight refuses Replace on step scaling with more than 2 step adjustments because the original cannot be reconstructed safely from rawSpec. Adopt-as-is remains available.

Predictive scaling: for daily and weekly patterns

Predictive scaling uses historical metrics to forecast capacity needs over the next 24-48 hours and pre-provisions instances. It avoids the cold-start cost of scaling out under load. Predictive scaling is most useful for workloads with strong daily patterns (e-commerce traffic, batch processing windows). ZopNight does not write predictive scaling policies because the predicted capacity model lives in AWS, but it adopts existing policies under zero-mutation observation.

Scheduled scaling: for known events

Scheduled scaling adds capacity at a planned time. ZopNight Event Readiness writes scheduled actions for known traffic spikes (Black Friday, product launches). The lifecycle handles rollback automatically through originalMin/Max/Desired snapshotting. RC-ASC-001 flags AWS ASG without any scaling policies. RC-ASC-002 flags Azure VMSS without an autoscale setting. RC-ASC-003 flags GCP MIG without an autoscaler.

Key takeaways

• Target tracking is the right default for most production services.
• Step scaling beats target tracking when burst latency is a problem and target tracking does not react fast enough.
• Predictive scaling fits workloads with strong daily or weekly patterns and avoids cold-start scaling cost.
• 6 ZopNight autoscaler rules (RC-ASC-001 to RC-ASC-006) catch missing autoscalers, hot/cold targets, and short cooldowns.

Where ZopNight fits

ZopNight turns this from reading into doing. It ships 490 built-in audit rules across AWS (216), GCP (127), and Azure (147), 124 of those recommendations are wired to act end to end, 28 one-click and 96 guided, and it starts read-only so you can see the opportunity before you act on any of it. The most direct place to begin is scheduling non-production resources to your working hours, which is covered in the FinOps guide and shown concretely for AWS EC2.

How ZopNight schedules non-production resources

The loop that does this is deliberately mechanical, and it starts read-only. You connect your cloud provider with a read-only role, and ZopNight discovers every non-production resources across your regions and accounts. It records a per-action permission verdict for each one, so you can see where it can list a resource but not yet stop it, and you review that inventory, filter it by status or type, and search for the specific resources you care about before anything is scheduled.

Scheduling itself is a cron you write once in plain terms, stop at 7 PM, start at 8 AM on weekdays, pinned to your timezone so the jobs fire at local business hours rather than UTC. A weekly 24-hour grid shows the schedule visually so you catch gaps and overlaps before you save, and an estimate of active versus inactive hours appears before you commit. Resources attach individually or bundle into groups like “dev-cluster” or “staging-db” so a whole environment follows one cadence.

Actions run in dependency order, so a database comes up before the app server that depends on it. When something needs to stay up, an override forces a non-production resources ON or OFF for a defined window, carries a reason so teammates understand why it exists, and expires automatically so nothing is left running by accident. If a start or stop fails, ZopNight retries up to three times and falls back to a dead-letter queue rather than silently dropping the action, and every state change lands in an audit trail that records whether a schedule, an override, or a specific user triggered it.

Getting started

Getting started is intentionally low-stakes:

• Connect your cloud provider with a read-only role. Nothing is scheduled or changed at this stage.
• Let ZopNight discover your non-production resources and review exactly what it found, filtered by account, region, and status.
• Create a schedule in your timezone and attach the non-production resources or groups you want it to cover.
• Watch the first cycle run, with Slack, Teams, or Google Chat notifications on every start, stop, and failure, then layer in idle cleanup and guided rightsizing.

Production stays excluded by default throughout, and because discovery and recommendations are read-only, you can prove the value before you enable a single action.