Amazon EC2 Auto Scaling group uses an EC2 launch template

Check ID: autoscaling_group_using_ec2_launch_template
Provider: AWS
Service: autoscaling
Severity: MEDIUM
Categories: resilience
Resource type: AwsAutoScalingAutoScalingGroup

What this check verifies

EC2 Auto Scaling groups use an EC2 launch template directly or via a mixed instances policy to define instance configuration and versioned settings.

Risk

Without a launch template, there is no versioned, auditable baseline for instance settings, increasing configuration drift. Inconsistent metadata and network options can enable unauthorized access or unstable deployments, degrading confidentiality and availability.

Recommendation

Adopt launch templates for all Auto Scaling groups and include them in any mixed instances policy. Use versioning with approvals, enforce hardened defaults (least privilege roles, secure metadata like IMDSv2, encrypted storage), and apply change control to ensure consistency and defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws autoscaling update-auto-scaling-group --auto-scaling-group-name <example_resource_name> --launch-template LaunchTemplateId=<template-id>

# Terraform: attach a Launch Template to the ASG
resource "aws_autoscaling_group" "example" {
  min_size            = 0
  max_size            = 1
  vpc_zone_identifier = ["<example_subnet_id>"]

  launch_template {
    id      = "<example_launch_template_id>" # critical: ensures the ASG uses an EC2 launch template (fixes the check)
    version = "$Default"
  }
}

# CloudFormation: attach a Launch Template to the ASG
Resources:
  ASG:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      MinSize: '0'
      MaxSize: '1'
      VPCZoneIdentifier:
        - <example_subnet_id>
      LaunchTemplate: # critical: ensures the ASG uses an EC2 launch template (fixes the check)
        LaunchTemplateId: <example_launch_template_id> # references the EC2 Launch Template
        Version: $Default

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = autoscaling_group_using_ec2_launch_template. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Auto Scaling group spans multiple AZs and instance types Lambda environment variables use a customer-managed key

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires