Assigning public IP addresses expose your instances to public internet

Severity	Exploitability	Providers	Categories
HIGH	MEDIUM	AWS	NETWORK

Description

A launch configuration is an instance configuration template that an Auto Scaling group uses to launch EC2 instances.

Associating a public IP address to these instances will expose them to the public internet. Note that if your instances are spawned in a public Virtual Private Cloud, a public IP address will be assigned to them even if you switch off the associate_public_ip_address_setting in the launch group configuration.

Impact

Potential data exposure	Visible in logs	User interaction required	Privileges required
True	True	False	False

Having open ingress means anyone can try and connect to the asset.

If credentials are required to establish a connection, it still leaves open the possibility to bruteforce the credentials, or perform Denial of Service attacks.
If no credentials are required, or credentials have been acquired by an attacker, then the asset is fully compromised.

Remediation guidelines

Modify the launch configuration to disable the public IP address association.
Terminate and recreate the existing instances that were launched with this configuratio, so that the new parameters are taken into account.