Check ID: autoscaling_group_launch_configuration_no_public_ip
Provider: AWS
Service: autoscaling
Severity: HIGH
Categories: internet-exposed
Resource type: AwsAutoScalingAutoScalingGroup

​
What this check verifies

Amazon EC2 Auto Scaling groups are evaluated to determine whether their associated launch configuration assigns public IP addresses to instances (e.g., AssociatePublicIpAddress=true).

​
Risk

Publicly addressable instances are reachable from the Internet, enabling reconnaissance, brute-force, and exploitation of exposed services. Compromise can lead to remote access, data exfiltration, and lateral movement, impacting confidentiality, integrity, and availability.

​
Recommendation

Place instances in private subnets and disable public addressing (AssociatePublicIpAddress=false). Publish services via load balancers or private endpoints, enforce least privilege security groups, and use SSM, VPN, or a hardened bastion for admin access. Prefer launch templates to standardize network controls.

​
Remediation

# Launch Configuration without public IPs
resource "aws_launch_configuration" "<example_resource_name>" {
  image_id                    = "<example_ami_id>"
  instance_type               = "<example_instance_type>"
  associate_public_ip_address = false  # Critical: disables assigning public IPs
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = autoscaling_group_launch_configuration_no_public_ip. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks