iCompaas Support

Profile Applicability

• Level 2

Description

EC2 Launch Templates provide a more powerful and flexible way to configure Amazon EC2 Auto Scaling Groups compared to Launch Configurations. Using Launch Templates enables features such as Mixed Instances Policies, T2 Unlimited, Spot Instances, Capacity Reservations, and Elastic Graphics. Ensuring that Auto Scaling Groups are using Launch Templates allows you to take full advantage of these advanced features.

Rationale

• Enhanced Flexibility: Supports advanced features, such as multiple instance types and versions.

• Improved Efficiency: Simplifies scaling configurations and management.

• Cost Optimization: Supports Spot Instances and optimized capacity allocation.

Impact

Pros:

• Allows advanced configurations that are not possible with Launch Configurations.

• Reduces the need to create separate configurations for different instances or options.

• Enhances scalability and workload resilience.

Cons:

• Requires migrating from Launch Configurations if they are still in use.

• Slightly more complex setup compared to Launch Configurations.

Default Value

By default, EC2 Auto Scaling Groups may still use older Launch Configurations unless explicitly updated to use Launch Templates.

Pre-Requisite

IAM Permissions Required:

• autoscaling:DescribeAutoScalingGroups

• ec2:DescribeLaunchTemplates

• AWS CLI installed and configured.

Remediation

Test Plan:

Using AWS Console:

1. Sign in to the AWS Management Console.

2. Navigate to EC2 > Auto Scaling Groups.

3. Select your Auto Scaling Group and view its Details.

4. Check the Launch Configuration/Launch Template section to verify whether it uses a Launch Template.

Using AWS CLI:

1. Describe the Auto Scaling Group:
   

   aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names <asg-name>

2. Check the output for the LaunchTemplate field. If this field is present, the Auto Scaling Group is using a Launch Template. If the field LaunchConfigurationName appears instead, the group is using a Launch Configuration.

Implementation Steps:

Using AWS Console:

1. Navigate to EC2 > Launch Templates and create a new Launch Template with the desired configurations if one does not already exist.

2. Navigate to Auto Scaling Groups and select the group to update.

3. Click Edit and replace the existing Launch Configuration with the new Launch Template.

4. Save the changes.

Using AWS CLI:

1. Create a new Launch Template:
   

   aws ec2 create-launch-template --launch-template-name <template-name> --version-description <description> --launch-template-data file://launch-template.json

2. Update the Auto Scaling Group to use the new Launch Template:
   

   aws autoscaling update-auto-scaling-group \
   --auto-scaling-group-name <asg-name> \
   --launch-template "LaunchTemplateName=<template-name>,Version=$Latest"

3. Verify the updated configuration:
   

   aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names <asg-name>

Backout Plan

Using AWS Console:

1. If using a Launch Template causes issues, sign in to the AWS Management Console.

2. Navigate to EC2, then to Auto Scaling Groups.

3. Select the Auto Scaling Group and go to the Instance management section.

4. Switch the Launch Template back to a Launch Configuration if necessary.

5. Save the changes and verify that the Auto Scaling Group is reverted to using a Launch Configuration.

Using AWS CLI:

1. To revert to using a Launch Configuration, run:
   

   aws autoscaling update-auto-scaling-group --auto-scaling-group-name <ASG_NAME> --launch-configuration-name <LAUNCH_CONFIG_NAME>

2. Verify that the Auto Scaling Group is now using the Launch Configuration:
   

   aws autoscaling describe-auto-scaling-groups --auto-scaling-group-name <ASG_NAME>

References

• Using Launch Templates with Auto Scaling Groups

• Creating a Launch Template

• AWS Auto Scaling User Guide

CIS Controls