Back to Checks
aws

Amazon EC2 Auto Scaling group uses an EC2 launch template

autoscaling_group_using_ec2_launch_template
Service: autoscalingSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsAutoScalingAutoScalingGroup

EC2 Auto Scaling groups use an EC2 launch template directly or via a mixed instances policy to define instance configuration and versioned settings.

Prowler logoProwlerprowler-provider-aws

Risk

Without a launch template, there is no versioned, auditable baseline for instance settings, increasing configuration drift. Inconsistent metadata and network options can enable unauthorized access or unstable deployments, degrading confidentiality and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks autoscaling_group_using_ec2_launch_template

Recommendation

Adopt launch templates for all Auto Scaling groups and include them in any mixed instances policy. Use versioning with approvals, enforce hardened defaults (least privilege roles, secure metadata like IMDSv2, encrypted storage), and apply change control to ensure consistency and defense in depth.

Remediation

CLI

aws autoscaling update-auto-scaling-group --auto-scaling-group-name <example_resource_name> --launch-template LaunchTemplateId=<template-id>

Terraform

# Terraform: attach a Launch Template to the ASG
resource "aws_autoscaling_group" "example" {
  min_size            = 0
  max_size            = 1
  vpc_zone_identifier = ["<example_subnet_id>"]

  launch_template {
    id      = "<example_launch_template_id>" # critical: ensures the ASG uses an EC2 launch template (fixes the check)
    version = "$Default"
  }
}

NativeIaC

# CloudFormation: attach a Launch Template to the ASG
Resources:
  ASG:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      MinSize: '0'
      MaxSize: '1'
      VPCZoneIdentifier:
        - <example_subnet_id>
      LaunchTemplate: # critical: ensures the ASG uses an EC2 launch template (fixes the check)
        LaunchTemplateId: <example_launch_template_id> # references the EC2 Launch Template
        Version: $Default

Other

1In the AWS console, go to EC2 > Auto Scaling Groups
2Select <example_resource_name> and click Edit
3Under "Launch template or configuration", choose Launch template and select your template and version (Default or Latest)
4Click Update to save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.autoscaling.autoscaling_client import (
    autoscaling_client,
)


class autoscaling_group_using_ec2_launch_template(Check):
    def execute(self):
        findings = []
        for group in autoscaling_client.groups:
            report = Check_Report_AWS(metadata=self.metadata(), resource=group)

            report.status = "PASS"
            report.status_extended = (
                f"Autoscaling group {group.name} is using an EC2 launch template."
            )
            if (
                not group.launch_template
                and not group.mixed_instances_policy_launch_template
            ):
                report.status = "FAIL"
                report.status_extended = f"Autoscaling group {group.name} is not using an EC2 launch template."

            findings.append(report)

        return findings

References