All checks
High
Amazon EC2 instances launched using Auto Scaling group launch configurations should not have Public IP addresses
Checks that the launch configuration does not assign public IP addresses to its instances (AssociatePublicIpAddress true); they should be reached through a load balancer, not directly from the internet. One that leaves it unset passes, and its instances then follow the subnet's auto-assign setting. Every launch configuration in the Region is read, used or not; groups on launch templates are not.
- service
- AutoScaling
- severity
- High
- scope
- evaluated in every region
How to fix it
- Replaces the resource: A launch configuration cannot be changed: copy it to a launch template, add a version with public IPs disabled and make it the default, switch each group to it, then delete this one.
- Can break clients: Replacement instances need a NAT gateway or VPC endpoints for outbound traffic, and anything that reached them by public address needs a load balancer or Session Manager.
- Affects another check: EC2.25 fails the new template while its default is the copied version, and EC2.9 fails each running instance until the group replaces it.
In the console
EC2 → Auto Scaling → Launch configurations, and the Launch template or configuration setting on the Auto Scaling group
- Auto-assign public IP
- Disable, in the launch template's network interface
- Launch template
- The new template, on each group using this launch configuration
- Version
- Default
See which of your accounts this check is failing on.
Book a live scan