A launch configuration is an instance configuration template that an Auto Scaling group uses to launch EC2 instances.
Associating a public IP address to these instances will expose them to the public internet. Note that if your instances are spawned in a public Virtual Private Cloud, a public IP address will be assigned to them even if you switch off the associate_public_ip_address_setting in the launch group configuration.
|Potential data exposure||Visible in logs||User interaction required||Privileges required|
Having open ingress means anyone can try and connect to the asset.
- If credentials are required to establish a connection, it still leaves open the possibility to bruteforce the credentials, or perform Denial of Service attacks.
- If no credentials are required, or credentials have been acquired by an attacker, then the asset is fully compromised.
- Modify the launch configuration to disable the public IP address association.
- Terminate and recreate the existing instances that were launched with this configuratio, so that the new parameters are taken into account.