Back to Checks
aws

Auto Scaling group associated launch configuration does not assign a public IP address

autoscaling_group_launch_configuration_no_public_ip
Service: autoscalingSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsAutoScalingAutoScalingGroup

Amazon EC2 Auto Scaling groups are evaluated to determine whether their associated launch configuration assigns public IP addresses to instances (e.g., AssociatePublicIpAddress=true).

Prowler logoProwlerprowler-provider-aws

Risk

Publicly addressable instances are reachable from the Internet, enabling reconnaissance, brute-force, and exploitation of exposed services.

Compromise can lead to remote access, data exfiltration, and lateral movement, impacting confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks autoscaling_group_launch_configuration_no_public_ip

Recommendation

Place instances in private subnets and disable public addressing (AssociatePublicIpAddress=false). Publish services via load balancers or private endpoints, enforce least privilege security groups, and use SSM, VPN, or a hardened bastion for admin access. Prefer launch templates to standardize network controls.

Remediation

Terraform

# Launch Configuration without public IPs
resource "aws_launch_configuration" "<example_resource_name>" {
  image_id                    = "<example_ami_id>"
  instance_type               = "<example_instance_type>"
  associate_public_ip_address = false  # Critical: disables assigning public IPs
}

NativeIaC

# CloudFormation Launch Configuration without public IPs
Resources:
  <example_resource_name>:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      ImageId: <example_ami_id>
      InstanceType: <example_instance_type>
      AssociatePublicIpAddress: false  # Critical: disables assigning public IPs to instances

Other

1In the AWS console, go to EC2 > Auto Scaling > Launch configurations and click Create launch configuration
2Use the same AMI and instance type as the current group; under Advanced details set IP address type to Do not assign a public IP address
3Create the launch configuration
4Go to EC2 > Auto Scaling Groups, select your group, click Edit next to Launch configuration, choose the new configuration, and click Update

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.autoscaling.autoscaling_client import (
    autoscaling_client,
)


class autoscaling_group_launch_configuration_no_public_ip(Check):
    def execute(self):
        findings = []
        for group in autoscaling_client.groups:
            for lc in autoscaling_client.launch_configurations.values():
                if lc.name == group.launch_configuration_name:
                    report = Check_Report_AWS(metadata=self.metadata(), resource=group)

                    report.status = "PASS"
                    report.status_extended = f"Autoscaling group {group.name} does not have an associated launch configuration assigning a public IP address."

                    if lc.public_ip:
                        report.status = "FAIL"
                        report.status_extended = f"Autoscaling group {group.name} has an associated launch configuration assigning a public IP address."

                    findings.append(report)

        return findings

References