AWS EC2 launch templates should not assign public IPs to network interfaces¶

This control checks if AWS EC2 launch templates are configured to assign public IP addresses to network interfaces upon launch. The control fails if an EC2 launch template is configured to assign a public IP address to network interfaces or if there is at least one network interface that has a public IP address.

How to fix¶

Attribute network_interfaces[0].associate_public_ip_address of aws_launch_template must be "false".

Implementation options¶

Choose the option that matches how you manage Terraform. All options satisfy this control.

Option 1: Terraform AWS provider resources¶

If you manage resources directly, configure the relevant Terraform AWS provider resources to meet this control. See docs for the resources involved: aws_launch_template.

resource "aws_launch_template" "this" {
  network_interfaces {
    associate_public_ip_address = "false"
  }
}

Which option should I choose?

Compliance.tf module (recommended): controls enforced by default and mapped to frameworks.
Open source module (terraform-aws-modules): compatible by design with compliance.tf. Same variable names for an easy, low-change migration path when you are ready.
Terraform AWS provider resources: manage Terraform resources directly.

Tool mappings¶

Use these identifiers to cross-reference this control across tools, reports, and evidence.

Compliance.tf (CTF) Control: ec2_launch_template_not_publicly_accessible
AWS Config Managed Rule: EC2_LAUNCH_TEMPLATE_PUBLIC_IP_DISABLED
Powerpipe Control: aws_compliance.control.ec2_launch_template_not_publicly_accessible