EC2 launch template assigns no public IP addresses

Check ID: ec2_launch_template_no_public_ip
Provider: AWS
Service: ec2
Severity: HIGH
Categories: internet-exposed
Resource type: AwsEc2LaunchTemplate

What this check verifies

EC2 launch templates with versions that either enable associate_public_ip_address for network interfaces or reference ENIs already associated with public IPs

Risk

Assigning public IPs makes instances Internet-reachable, enabling:

Loss of confidentiality via unauthorized access and data exfiltration
Compromised integrity through remote exploitation and tampering
Reduced availability from DDoS and brute-force traffic Attackers can scan exposed services and pivot within the VPC.

Recommendation

Apply least privilege and network segmentation:

Set associate_public_ip_address=false in launch templates
Avoid referencing ENIs with public IPs
Place instances in private subnets behind NAT/ALB
Use Session Manager, bastions, or VPC endpoints/PrivateLink for access Adopt defense in depth to minimize exposure.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 create-launch-template-version --launch-template-id <example_resource_id> --launch-template-data '{"NetworkInterfaces":[{"DeviceIndex":0,"AssociatePublicIpAddress":false}]}' --set-default-version

# EC2 launch template configured to not assign public IPs
resource "aws_launch_template" "<example_resource_name>" {
  name = "<example_resource_name>"

  network_interfaces {
    device_index                = 0
    associate_public_ip_address = false  # Critical: disables public IP assignment on the primary ENI
  }
}

# CloudFormation: Launch template configured to not assign public IPs
Resources:
  <example_resource_name>:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateData:
        NetworkInterfaces:
          - DeviceIndex: 0
            AssociatePublicIpAddress: false  # Critical: disables public IP assignment on the primary ENI

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_launch_template_no_public_ip. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires