EC2 subnets should not automatically assign public IP addresses

How to fix it

• Can break clients: New instances here get no public IPv4 address, so any that need the internet must go through a NAT gateway or request an address at launch.
• Affects another check: Running instances keep the public IPv4 addresses they already have, so EC2.9 still fails on each one until its address is removed.

In the console

VPC → Subnets → the subnet → Actions → Edit subnet settings → Auto-assign IP settings

Enable auto-assign public IPv4 address

Cleared

Enable auto-assign IPv6 address

Cleared (the CLI route covers IPv4 only; rerun it with --no-assign-ipv6-address-on-creation)

With the AWS CLI

aws ec2 modify-subnet-attribute --subnet-id <subnet-id> --no-map-public-ip-on-launch --region <region>

With Terraform

resource "aws_subnet" "this" {
  vpc_id                          = var.vpc_id
  cidr_block                      = var.cidr_block
  map_public_ip_on_launch         = false
  assign_ipv6_address_on_creation = false
}