# Ensure Auto Scaling Group Launch Configuration Does Not Assign a Public IP Address

- Source: https://support.icompaas.com/support/solutions/articles/a_1788890020976826-ensure-auto-scaling-group-launch-configuration-does-not-assign-a-public-ip-address
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Cloud](https://support.icompaas.com/support/solutions/c_1788889426924716) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1788889470630116)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that the launch configuration (or launch template) used by an EC2 Auto Scaling group does not automatically assign a public IP address to instances launched in a public subnet, unless the workload genuinely requires direct inbound or outbound internet connectivity.

**Rationale**

Instances launched with a public IP address are directly reachable from the internet unless restricted by security groups and network ACLs, increasing the exposed attack surface. For most application-tier and data-tier workloads, instances should reside in private subnets and reach the internet (if needed) via a NAT gateway, rather than being assigned a public IP address directly.

**Impact**

-   Reduces the direct internet-facing attack surface of Auto Scaling group instances
    
-   Encourages the use of NAT gateways or VPC endpoints for necessary outbound connectivity
    
-   May require network architecture changes (private subnets, NAT gateway) if instances currently depend on a public IP for internet access
    

**Default Value**

Whether a public IP address is assigned depends on the subnet's auto-assign public IP setting and the launch template/configuration's network interface settings; there is no single AWS-wide default, and this must be explicitly reviewed.

**Pre-Requisites**

-   A private subnet and NAT gateway (or VPC endpoints) available for the workload's outbound connectivity needs
    
-   IAM permissions to create a new launch template version and update the Auto Scaling group (autoscaling:UpdateAutoScalingGroup, ec2:CreateLaunchTemplateVersion)
    

**Test Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to EC2 > Auto Scaling Groups and select the group to review.
    
3.  Open the Instance management tab and review the associated launch template or launch configuration.
    
4.  Review the Network settings / Auto-assign public IP field.
    
5.  Verify that Auto-assign public IP is disabled unless the instances have an approved, documented need for direct public IP addressing.
    
6.  If public IP assignment is enabled without justification, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to EC2 > Launch Templates, select the template used by the Auto Scaling group, and select Create template version (launch configurations are legacy and must be replaced with a launch template to make this change).
    
3.  In the Network settings, set Auto-assign public IP to Disable.
    
4.  Ensure the target subnet(s) route outbound traffic through a NAT gateway if internet access is still required.
    
5.  Save the new launch template version.
    
6.  Navigate to the Auto Scaling group, select Edit, and update it to use the new launch template version.
    
7.  Trigger an instance refresh so existing instances are replaced with instances launched under the new configuration.
    

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to EC2 > Launch Templates, select the relevant template, and create a new version.
    
3.  Set Auto-assign public IP back to Enable.
    
4.  Update the Auto Scaling group to use this launch template version and trigger an instance refresh.
    

**Reference**

-   [https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.