Skip to main content
emnode
Sign up
Compliance Medium severity

AWS Security Hub · AutoScaling

AutoScaling.9: Deprecated launch configurations are still in use

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub AutoScaling.9 check?

AutoScaling.9 fails when an Auto Scaling group is still backed by a launch configuration rather than a launch template. The control checks whether the group references a LaunchConfigurationName instead of a LaunchTemplate.

Why does AutoScaling.9 matter?

AWS deprecated launch configurations in 2022, and they cannot express newer capabilities (pinned IMDSv2 metadata options, mixed instance policies, and current instance generations). A group stuck on a launch configuration is unable to enforce the single biggest hardening move, IMDSv2, on its fleet. Migrating to launch templates unblocks that and keeps the group on a supported provisioning path.

How do I fix AutoScaling.9?

  1. Discover which groups still reference a launch configuration.
  2. Create an equivalent launch template from the existing settings, watching the field-mapping differences.
  3. Attach the launch template to the group as its launch source.
  4. Run an instance refresh to roll the fleet onto the template with zero downtime.

Remediation script · bash

# Swap the ASG's launch source from LC to LT (running instances are untouched).
aws autoscaling update-auto-scaling-group \
  --auto-scaling-group-name prod-api-asg \
  --launch-template LaunchTemplateId=lt-0fe3d2c1b4a5968e7,Version='$Latest'

# Roll the fleet to the new template at 90% min-healthy.
aws autoscaling start-instance-refresh \
  --auto-scaling-group-name prod-api-asg \
  --preferences '{"MinHealthyPercentage":90,"InstanceWarmup":120}'

# Verify the LC reference is gone; AutoScaling.9 should clear on next eval.
aws autoscaling describe-auto-scaling-groups \
  --auto-scaling-group-names prod-api-asg \
  --query 'AutoScalingGroups[0].{LC:LaunchConfigurationName,LT:LaunchTemplate}'

Full walkthrough (console steps, edge cases and verification) in the lesson Migrate ASGs from Launch Configurations to Launch Templates.

Is AutoScaling.9 a false positive?

Some Auto Scaling groups are created and owned by a higher-level service that still provisions them from a launch configuration (older Elastic Beanstalk environments are the classic case), so the group genuinely references a launch configuration even though you never authored it and can't simply swap in a launch template without breaking the managing service. The control reports FAILED here because it only inspects whether the group points at a launch configuration or a launch template, not who manages it. Rather than hand-editing a service-managed group, follow the owning service's own path to a launch template (for Beanstalk, a newer platform version or a launch-template config option) and, until that lands, document the group and suppress the finding in Security Hub so it doesn't mask groups you actually do control.

Full lesson Migrate ASGs from Launch Configurations to Launch Templates Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for AutoScaling controls ↗ Check your own account for AutoScaling.9 →

More AutoScaling controls