If the AZ goes down, then new instances are spun up in a different AZ, if necessary. As soon as the first AZ comes back to life, auto scaling will try to launch the instances there and try rebalancing the load appropriately. This is the only time the number of instances can go above max capacity specified (for a short amount of time). As soon as a certain amount of capacity is available in AZ 1, it will start terminating the instances in AZ 2.
Instances that fail can be seamlessly replaced using auto-scaling while other instances continue to operate. Although auto-replacement of instances works really well, storing application state or caching locally on your instances can lead to ...
