Project: KICS (Provisioning / Security & Compliance)
File: ba48df05-eaa1-4d64-905e-4a4b051e7587.md

title: Autoscaling Groups Supply Tags hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: ba48df05-eaa1-4d64-905e-4a4b051e7587 Query name: Autoscaling Groups Supply Tags Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Availability URL: Autoscaling groups should supply tags to configurate<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awsautoscalinggroup" "positive1" { name = "foobar3-terraform-test" max_size = 5 min_size = 2 launchconfiguration = awslaunch_configuration.foobar.name vpczoneidentifier = [awssubnet.example1.id, awssubnet.example2.id] } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="1" module "asg" { source = "terraform-aws-modules/autoscaling/aws" version = "~> 4.0" name = "example-asg" min_size = 0 max_size = 1 desired_capacity = 1 waitforcapacity_timeout = 0 healthchecktype = "EC2" vpczoneidentifier = ["subnet-1235678", "subnet-87654321"] initiallifecyclehooks = [ { name = "ExampleStartupLifeCycleHook" default_result = "CONTINUE" heartbeat_timeout = 60 lifecycletransition = "autoscaling:EC2INSTANCE_LAUNCHING" notification_metadata = jsonencode({ "hello" = "world" }) }, { name = "ExampleTerminationLifeCycleHook" default_result = "CONTINUE" heartbeat_timeout = 180 lifecycletransition = "autoscaling:EC2INSTANCE_TERMINATING" notification_metadata = jsonencode({ "goodbye" = "world" }) } ] instance_refresh = { strategy = "Rolling" preferences = { minhealthypercentage = 50 } triggers = ["tag"] } lt_name = "example-asg" description = "Launch template example" updatedefaultversion = true use_lt = true create_lt = true image_id = "ami-ebd02392" instance_type = "t3.micro" ebs_optimized = true enable_monitoring = true blockdevicemappings = [ { device_name = "/dev/xvda" no_device = 0 ebs = { deleteontermination = true encrypted = true volume_size = 20 volume_type = "gp2" } }, { device_name = "/dev/sda1" no_device = 1 ebs = { deleteontermination = true encrypted = true volume_size = 30 volume_type = "gp2" } } ] capacityreservationspecification = { capacityreservationpreference = "open" } cpu_options = { core_count = 1 threadspercore = 1 } credit_specification = { cpu_credits = "standard" } instancemarketoptions = { market_type = "spot" spot_options = { blockdurationminutes = 60 } } metadata_options = { http_endpoint = "enabled" http_tokens = "required" httpputresponsehoplimit = 32 } network_interfaces = [ { deleteontermination = true description = "eth0" device_index = 0 security_groups = ["sg-12345678"] }, { deleteontermination = true description = "eth1" device_index = 1 security_groups = ["sg-12345678"] } ] placement = { availability_zone = "us-west-1b" } tag_specifications = [ { resource_type = "instance" tags = { WhatAmI = "Instance" } }, { resource_type = "volume" tags = { WhatAmI = "Volume" } }, { resource_type = "spot-instances-request" tags = { WhatAmI = "SpotInstanceRequest" } } ] } ``` ```tf title="Negative test

1 - tf file" resource "awsautoscalinggroup" "negative1" { name = "foobar3-terraform-test" max_size = 5 min_size = 2 launchconfiguration = awslaunch_configuration.foobar.name vpczoneidentifier = [awssubnet.example1.id, awssubnet.example2.id] tags = concat( [ { "key" = "interpolation1" "value" = "value3" "propagateatlaunch" = true }, { "key" = "interpolation2" "value" = "value4" "propagateatlaunch" = true }, ], ) } ``` ```tf title="Negative test num. 2 - tf file" resource "awsautoscalinggroup" "negative2" { name = "foobar3-terraform-test" max_size = 5 min_size = 2 launchconfiguration = awslaunch_configuration.foobar.name vpczoneidentifier = [awssubnet.example1.id, awssubnet.example2.id] tag { key = "foo" value = "bar" propagateatlaunch = true } } ``` ```tf title="Negative test num. 3 - tf file" module "asg" { source = "terraform-aws-modules/autoscaling/aws" version = "~> 4.0" name = "example-asg" min_size = 0 max_size = 1 desired_capacity = 1 waitforcapacity_timeout = 0 healthchecktype = "EC2" vpczoneidentifier = ["subnet-1235678", "subnet-87654321"] initiallifecyclehooks = [ { name = "ExampleStartupLifeCycleHook" default_result = "CONTINUE" heartbeat_timeout = 60 lifecycletransition = "autoscaling:EC2INSTANCE_LAUNCHING" notification_metadata = jsonencode({ "hello" = "world" }) }, { name = "ExampleTerminationLifeCycleHook" default_result = "CONTINUE" heartbeat_timeout = 180 lifecycletransition = "autoscaling:EC2INSTANCE_TERMINATING" notification_metadata = jsonencode({ "goodbye" = "world" }) } ] instance_refresh = { strategy = "Rolling" preferences = { minhealthypercentage = 50 } triggers = ["tag"] } lt_name = "example-asg" description = "Launch template example" updatedefaultversion = true use_lt = true create_lt = true image_id = "ami-ebd02392" instance_type =

ebs_optimized = true enable_monitoring = true blockdevicemappings = [ { device_name = "/dev/xvda" no_device = 0 ebs = { deleteontermination = true encrypted = true volume_size = 20 volume_type = "gp2" } }, { device_name = "/dev/sda1" no_device = 1 ebs = { deleteontermination = true encrypted = true volume_size = 30 volume_type = "gp2" } } ] capacityreservationspecification = { capacityreservationpreference = "open" } cpu_options = { core_count = 1 threadspercore = 1 } credit_specification = { cpu_credits = "standard" } instancemarketoptions = { market_type = "spot" spot_options = { blockdurationminutes = 60 } } metadata_options = { http_endpoint = "enabled" http_tokens = "required" httpputresponsehoplimit = 32 } network_interfaces = [ { deleteontermination = true description = "eth0" device_index = 0 security_groups = ["sg-12345678"] }, { deleteontermination = true description = "eth1" device_index = 1 security_groups = ["sg-12345678"] } ] placement = { availability_zone = "us-west-1b" } tag_specifications = [ { resource_type = "instance" tags = { WhatAmI = "Instance" } }, { resource_type = "volume" tags = { WhatAmI = "Volume" } }, { resource_type = "spot-instances-request" tags = { WhatAmI = "SpotInstanceRequest" } } ] tags = [ { key = "Environment" value = "dev" propagateatlaunch = true }, { key = "Project" value = "megasecret" propagateatlaunch = true }, ] tagsasmap = { extratag1 = "extravalue1" extratag2 = "extravalue2" } } ``` <details><summary>Negative test num. 4 - tf file</summary> ```tf module "asg" { source = "terraform-aws-modules/autoscaling/aws" version = "~> 4.0" name = "example-asg" min_size = 0 max_size = 1 desired_capacity = 1 waitforcapacity_timeout = 0 healthchecktype = "EC2" vpczoneidentifier = ["subnet-1235678", "subnet-87654321"] initiallifecyclehooks = [ { name = "ExampleStartupLifeCycleHook" default_result = "CONTINUE" heartbeat_timeout = 60 lifecycletransition = "autoscaling:EC2INSTANCE_LAUNCHING" notification_metadata = jsonencode({ "hello" = "world" }) }, { name = "ExampleTerminationLifeCycleHook" default_result = "CONTINUE" heartbeat_timeout = 180 lifecycletransition = "autoscaling:EC2INSTANCE_TERMINATING" notification_metadata = jsonencode({ "goodbye" = "world" }) } ] instance_refresh = { strategy = "Rolling" preferences = { minhealthypercentage = 50 } triggers = ["tag"] } tag { key = "foo" value = "bar" propagateatlaunch = true } lt_name = "example-asg" description = "Launch template example" updatedefaultversion = true use_lt = true create_lt = true image_id = "ami-ebd02392" instance_type = "t3.micro" ebs_optimized = true enable_monitoring = true blockdevicemappings = [ { device_name = "/dev/xvda" no_device = 0 ebs = { deleteontermination = true encrypted = true volume_size = 20 volume_type = "gp2" } }, { device_name = "/dev/sda1" no_device = 1 ebs = { deleteontermination = true encrypted = true volume_size = 30 volume_type = "gp2" } } ] capacityreservationspecification = { capacityreservationpreference = "open" } cpu_options = { core_count = 1 threadspercore = 1 } credit_specification = { cpu_credits = "standard" } instancemarketoptions = { market_type = "spot" spot_options = { blockdurationminutes = 60 } } metadata_options = { http_endpoint = "enabled" http_tokens = "required" httpputresponsehoplimit = 32 } network_interfaces = [ { deleteontermination = true description = "eth0" device_index = 0 security_groups = ["sg-12345678"] }, { deleteontermination = true description = "eth1" device_index = 1 security_groups = ["sg-12345678"] } ] placement = { availability_zone = "us-west-1b" } tag_specifications = [ { resource_type = "instance" tags = { WhatAmI = "Instance" } }, { resource_type = "volume" tags = { WhatAmI = "Volume" } }, { resource_type = "spot-instances-request" tags = { WhatAmI = "SpotInstanceRequest" } } ] tags = [ { key = "Environment" value = "dev" propagateatlaunch = true }, { key = "Project" value = "megasecret" propagateatlaunch = true }, ] tagsasmap = { extratag1 = "extravalue1" extratag2 = "extravalue2" } } ``` </details>