Description

Ensure that no Amazon EC2 Auto Scaling group uses a launch configuration that assigns public IP addresses to its instances. Instances should run in private subnets and be reached through load balancers, private endpoints or secure administrative access.

Rationale

Instances with public IP addresses can be reached directly from the Internet, which exposes them to scanning, brute-force attempts and exploitation of any service they run. A compromised instance can lead to remote access, data theft and movement to other resources. Placing instances in private subnets without public addresses, publishing services through load balancers, restricting security groups and using AWS Systems Manager, a VPN or a bastion host for administration reduces this exposure.

Impact

  • Removes direct Internet reachability of the group's instances

  • Instances without a public IP address need a NAT gateway, VPC endpoints or another route to reach the Internet or AWS services

  • Administrators or clients that connect directly to the instances' public addresses lose access and must use a load balancer, VPN, bastion host or Session Manager instead

  • Existing instances keep their public IP addresses until they are replaced

Default Value

A launch configuration assigns public IP addresses only if this is selected when it is created. If the option is not set, the setting of the subnet the instance is launched in applies. Launch configurations cannot be modified after creation.

Pre-Requisites

  • IAM permissions: autoscaling:DescribeAutoScalingGroups, autoscaling:DescribeLaunchConfigurations, autoscaling:UpdateAutoScalingGroup, autoscaling:StartInstanceRefresh, ec2:CreateLaunchTemplate and iam:PassRole (if the instances use an instance profile)

  • Private subnets with the required outbound connectivity (NAT gateway or VPC endpoints)

  • An alternative access path for administration and clients

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and select Auto Scaling Groups under Auto Scaling.

  3. Select a group and check on the Details tab whether it uses a launch configuration.

  4. If so, select Launch configurations under Auto Scaling, select that launch configuration and check its IP address type setting.

  5. Repeat for each group in each region in use.

  6. If the launch configuration assigns a public IP address to every instance, follow the implementation steps.

CLI:

List the launch configuration used by each group:

aws autoscaling describe-auto-scaling-groups --region <REGION> --query "AutoScalingGroups[].[AutoScalingGroupName,LaunchConfigurationName]" --output table

Show the public IP setting of a launch configuration:

aws autoscaling describe-launch-configurations --region <REGION> --launch-configuration-names <LAUNCH_CONFIGURATION_NAME> --query "LaunchConfigurations[].[LaunchConfigurationName,AssociatePublicIpAddress]" --output table

A group fails if its launch configuration has AssociatePublicIpAddress set to True. Groups that use a launch template are not evaluated.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and select Launch configurations under Auto Scaling.

  3. Select the launch configuration used by the group and choose Copy to launch template (AWS recommends launch templates, and new launch configurations cannot be created in many accounts).

  4. Create the launch template, and in its network settings make sure a public IP address is not assigned.

  5. Select Auto Scaling Groups, select the group and choose Edit in the Launch configuration section on the Details tab.

  6. Switch to the new launch template, and check that the group's subnets are private subnets.

  7. Choose Update.

  8. Replace the running instances, for example with Start instance refresh on the Instance refresh tab, so they no longer have public IP addresses.

  9. Repeat for each affected group in each region in use.

Backout Plan

Before making changes, save the group's current settings and keep the old launch configuration until the change is verified:

aws autoscaling describe-auto-scaling-groups --region <REGION> --auto-scaling-group-names <AUTO_SCALING_GROUP_NAME> > <AUTO_SCALING_GROUP_NAME>-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and select Auto Scaling Groups under Auto Scaling.

  3. Select the group and choose Edit in the launch template section of the Details tab.

  4. Switch back to the previous launch configuration and subnets from the saved backup, then choose Update.

  5. Start an instance refresh if the running instances must be replaced.

Note: rolling back makes the group's instances reachable from the Internet again.

Reference