Control: 2.14 Ensure EC2 Auto Scaling Groups Propagate Tags to EC2 Instances that it launches

Description

Tags can help with managing, identifying, organizing, searching for, and filtering resources. Additionally, tags can help with security and compliance. Tags can be propagated from an Auto Scaling group to the EC2 instances that it launches.

Remediation

AWS Console

Login to AWS Console using https://console.aws.amazon.com.
Click All services and click EC2 under Compute.
Select Auto Scaling Groups.
Click Edit for each Auto Scaling Group.
Check the Tag new instances Box for the Auto Scaling Group.
Click Update.
Repeat Steps 1-6 for each AWS Region used.

AWS CLI

Run aws autoscaling create-or-update-tags for tags that are not set to PropogateAtLaunch for each Auto Scaling Group that does not have this property set to true.

aws autoscaling create-or-update-tags \
--tags ResourceId=example-autoscaling-group,ResourceType=auto-scaling-
group,Key=TagKey,Value=TagValue,PropagateAtLaunch=true

Repeat Step 1 for each AWS Region used.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.cis_compute_service_v100_2_14

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.cis_compute_service_v100_2_14 --share

SQL

This control uses a named query:

autoscaling_group_propagate_tags_to_ec2_instance_enabled