EC2 launch templates should not assign public IPs to network interfaces

How to fix it

• Can break clients: Instances without a public address need a NAT gateway or VPC endpoints for outbound traffic and a load balancer for inbound, or they lose both routes.
• Affects another check: Instances already launched from the template keep their public addresses, so EC2.9 still fails on each one until it is replaced.

In the console

• Replaces the resource: A launch template version cannot be edited: create a new version with this disabled, then make it the default (Actions → Set default version), the only version this check reads.

EC2 → Launch Templates → the template → Actions → Modify template (Create new version) → Network settings → Advanced network configuration

Auto-assign public IP

Disable, on every network interface

With Terraform

resource "aws_launch_template" "this" {
  update_default_version = true
  network_interfaces {
    associate_public_ip_address = "false"
  }
}