Project: KICS (Provisioning / Security & Compliance)
File: 8e94dced-9bcc-4203-8eb7-7e41202b2505.md

title: Auto Scaling Group With No Associated ELB hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 8e94dced-9bcc-4203-8eb7-7e41202b2505 Query name: Auto Scaling Group With No Associated ELB Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Availability URL: AWS Auto Scaling Groups must have associated ELBs to ensure high availability and improve application performance. This means the attribute 'load_balancers' must be defined and not empty.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awsautoscalinggroup" "bar" { availability_zones = ["us-east-1a"] desired_capacity = 1 max_size = 1 min_size = 1 launch_template { id = awslaunchtemplate.foobar.id version = "$Latest" } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="12" resource "awsautoscalinggroup" "positive2" { availability_zones = ["us-east-1a"] desired_capacity = 1 max_size = 1 min_size = 1 launch_template { id = awslaunchtemplate.foobar.id version = "$Latest" } load_balancers = [] } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="1" module "positive3" { source = "terraform-aws-modules/autoscaling/aws" version = "~> 4.0" name = "example-asg" min_size = 0 max_size = 1 desired_capacity = 1 waitforcapacity_timeout = 0 healthchecktype = "EC2" vpczoneidentifier = ["subnet-1235678", "subnet-87654321"] initiallifecyclehooks = [ { name = "ExampleStartupLifeCycleHook" default_result = "CONTINUE" heartbeat_timeout = 60 lifecycletransition = "autoscaling:EC2INSTANCE_LAUNCHING" notification_metadata = jsonencode({ "hello" = "world" }) }, { name = "ExampleTerminationLifeCycleHook" default_result = "CONTINUE" heartbeat_timeout = 180 lifecycletransition = "autoscaling:EC2INSTANCE_TERMINATING" notification_metadata = jsonencode({ "goodbye" = "world" }) } ] instance_refresh = { strategy = "Rolling" preferences = { minhealthypercentage = 50 } triggers = ["tag"] } lt_name = "example-asg" description = "Launch template example" updatedefaultversion = true use_lt = true create_lt = true image_id = "ami-ebd02392" instance_type =

ebs_optimized = true enable_monitoring = true blockdevicemappings = [ { device_name = "/dev/xvda" no_device = 0 ebs = { deleteontermination = true encrypted = true volume_size = 20 volume_type = "gp2" } }, { device_name = "/dev/sda1" no_device = 1 ebs = { deleteontermination = true encrypted = true volume_size = 30 volume_type = "gp2" } } ] capacityreservationspecification = { capacityreservationpreference = "open" } cpu_options = { core_count = 1 threadspercore = 1 } credit_specification = { cpu_credits = "standard" } instancemarketoptions = { market_type = "spot" spot_options = { blockdurationminutes = 60 } } metadata_options = { http_endpoint = "enabled" http_tokens = "required" httpputresponsehoplimit = 32 } network_interfaces = [ { deleteontermination = true description = "eth0" device_index = 0 security_groups = ["sg-12345678"] }, { deleteontermination = true description = "eth1" device_index = 1 security_groups = ["sg-12345678"] } ] placement = { availability_zone = "us-west-1b" } tag_specifications = [ { resource_type = "instance" tags = { WhatAmI = "Instance" } }, { resource_type = "volume" tags = { WhatAmI = "Volume" } }, { resource_type = "spot-instances-request" tags = { WhatAmI = "SpotInstanceRequest" } } ] tags = [ { key = "Environment" value = "dev" propagateatlaunch = true }, { key = "Project" value = "megasecret" propagateatlaunch = true }, ] tagsasmap = { extratag1 = "extravalue1" extratag2 = "extravalue2" } } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="14" module "positive4" { source = "terraform-aws-modules/autoscaling/aws" version = "~> 4.0" name = "example-asg" min_size = 0 max_size = 1 desired_capacity = 1 waitforcapacity_timeout = 0 healthchecktype = "EC2" vpczoneidentifier = ["subnet-1235678", "subnet-87654321"] load_balancers = [] initiallifecyclehooks = [ { name = "ExampleStartupLifeCycleHook" default_result = "CONTINUE" heartbeat_timeout = 60 lifecycletransition = "autoscaling:EC2INSTANCE_LAUNCHING" notification_metadata = jsonencode({ "hello" = "world" }) }, { name = "ExampleTerminationLifeCycleHook" default_result = "CONTINUE" heartbeat_timeout = 180 lifecycletransition = "autoscaling:EC2INSTANCE_TERMINATING" notification_metadata = jsonencode({ "goodbye" = "world" }) } ] instance_refresh = { strategy = "Rolling" preferences = { minhealthypercentage = 50 } triggers = ["tag"] } lt_name = "example-asg" description = "Launch template example" updatedefaultversion = true use_lt = true create_lt = true image_id = "ami-ebd02392" instance_type = "t3.micro" ebs_optimized = true enable_monitoring = true blockdevicemappings = [ { device_name = "/dev/xvda" no_device = 0 ebs = { deleteontermination = true encrypted = true volume_size = 20 volume_type = "gp2" } }, { device_name = "/dev/sda1" no_device = 1 ebs = { deleteontermination = true encrypted = true volume_size = 30 volume_type = "gp2" } } ] capacityreservationspecification = { capacityreservationpreference = "open" } cpu_options = { core_count = 1 threadspercore = 1 } credit_specification = { cpu_credits = "standard" } instancemarketoptions = { market_type = "spot" spot_options = { blockdurationminutes = 60 } } metadata_options = { http_endpoint = "enabled" http_tokens = "required" httpputresponsehoplimit = 32 } network_interfaces = [ { deleteontermination = true description = "eth0" device_index = 0 security_groups = ["sg-12345678"] }, { deleteontermination = true description = "eth1" device_index = 1 security_groups = ["sg-12345678"] } ] placement = { availability_zone = "us-west-1b" } tag_specifications = [ { resource_type = "instance" tags = { WhatAmI = "Instance" } }, { resource_type = "volume" tags = { WhatAmI = "Volume" } }, { resource_type = "spot-instances-request" tags = { WhatAmI = "SpotInstanceRequest" } } ] tags = [ { key = "Environment" value = "dev" propagateatlaunch = true }, { key = "Project" value = "megasecret" propagateatlaunch = true }, ] tagsasmap = { extratag1 = "extravalue1" extratag2 = "extravalue2" } } ``` </details> <details><summary>Positive test num. 5 - tf file</summary> ```tf hl_lines="1" resource "awsautoscalinggroup" "foo" { name_prefix = "bar-" vpczoneidentifier = ["subnet-abcd1234", "subnet-1a2b3c4d"] launchconfiguration = awslaunch_configuration.foobar.name targetgrouparns = [] min_size = 1 max_size = 3 desired_capacity = 2 instance_refresh { strategy = "Rolling" preferences { minhealthypercentage = 50 } } } ``` </details> <details><summary>Positive test num. 6 - tf file</summary> ```tf hl_lines="1" resource "awsautoscalinggroup" "foo" { name_prefix = "bar-" vpczoneidentifier = ["subnet-abcd1234", "subnet-1a2b3c4d"] launchconfiguration = awslaunch_configuration.foobar.name min_size = 1 max_size = 3 desired_capacity = 2 instance_refresh { strategy = "Rolling" preferences { minhealthypercentage = 50 } } } ``` </details> ```tf title="Negative test

1 - tf file" resource "awsautoscalinggroup" "bar3" { availability_zones = ["us-east-1a"] desired_capacity = 1 max_size = 1 min_size = 1 launch_template { id = awslaunchtemplate.foobar.id version = "$Latest" } loadbalancers = ["elb1"] } ``` ```tf title="Negative test num. 2 - tf file" module "asg" { source = "terraform-aws-modules/autoscaling/aws" version = "~> 4.0" name = "example-asg" min_size = 0 max_size = 1 desired_capacity = 1 waitforcapacity_timeout = 0 healthchecktype = "EC2" vpczoneidentifier = ["subnet-1235678", "subnet-87654321"] loadbalancers = ["elb1"] initiallifecyclehooks = [ { name = "ExampleStartupLifeCycleHook" default_result = "CONTINUE" heartbeat_timeout = 60 lifecycletransition = "autoscaling:EC2INSTANCE_LAUNCHING" notification_metadata = jsonencode({ "hello" = "world" }) }, { name = "ExampleTerminationLifeCycleHook" default_result = "CONTINUE" heartbeat_timeout = 180 lifecycletransition = "autoscaling:EC2INSTANCE_TERMINATING" notification_metadata = jsonencode({ "goodbye" = "world" }) } ] instance_refresh = { strategy = "Rolling" preferences = { minhealthypercentage = 50 } triggers = ["tag"] } lt_name = "example-asg" description = "Launch template example" updatedefaultversion = true use_lt = true create_lt = true image_id = "ami-ebd02392" instance_type = "t3.micro" ebs_optimized = true enable_monitoring = true blockdevicemappings = [ { device_name = "/dev/xvda" no_device = 0 ebs = { deleteontermination = true encrypted = true volume_size = 20 volume_type = "gp2" } }, { device_name = "/dev/sda1" no_device = 1 ebs = { deleteontermination = true encrypted = true volume_size = 30 volume_type = "gp2" } } ] capacityreservationspecification = { capacityreservationpreference = "open" } cpu_options = { core_count = 1 threadspercore = 1 } credit_specification = { cpu_credits = "standard" } instancemarketoptions = { market_type = "spot" spot_options = { blockdurationminutes = 60 } } metadata_options = { http_endpoint = "enabled" http_tokens = "required" httpputresponsehoplimit = 32 } network_interfaces = [ { deleteontermination = true description = "eth0" device_index = 0 security_groups = ["sg-12345678"] }, { deleteontermination = true description = "eth1" device_index = 1 security_groups = ["sg-12345678"] } ] placement = { availability_zone = "us-west-1b" } tag_specifications = [ { resource_type = "instance" tags = { WhatAmI = "Instance" } }, { resource_type = "volume" tags = { WhatAmI = "Volume" } }, { resource_type = "spot-instances-request" tags = { WhatAmI = "SpotInstanceRequest" } } ] tags = [ { key = "Environment" value = "dev" propagateatlaunch = true }, { key = "Project" value = "megasecret" propagateatlaunch = true }, ] tagsasmap = { extratag1 = "extravalue1" extratag2 = "extravalue2" } } ``` ```tf title="Negative test num. 3 - tf file" resource "awsautoscalinggroup" "my_asg" { name_prefix = format("%s-", var.name) vpczoneidentifier = var.privatezoneidentifiers launchconfiguration = awslaunch_configuration.config.name targetgrouparns = [var.targetgrouparns] min_size = 1 max_size = 2 desired_capacity = 1 instance_refresh { strategy = "Rolling" preferences { minhealthypercentage = 50 } } } ``` <details><summary>Negative test num. 4 - tf file</summary> ```tf resource "awsautoscalinggroup" "foo" { name_prefix = "bar-" vpczoneidentifier = ["subnet-abcd1234", "subnet-1a2b3c4d"] launchconfiguration = awslaunch_configuration.foobar.name targetgrouparns = ["bar", "baz", "qux"] min_size = 1 max_size = 3 desired_capacity = 2 instance_refresh { strategy = "Rolling" preferences { minhealthypercentage = 50 } } } ``` </details>