Control: 2.14 Ensure EC2 Auto Scaling Groups Propagate Tags to EC2 Instances that it launches

Description

Tags can help with managing, identifying, organizing, searching for, and filtering resources. Additionally, tags can help with security and compliance. Tags can be propagated from an Auto Scaling group to the EC2 instances that it launches.

Remediation

AWS Console

Login to AWS Console using https://console.aws.amazon.com.
Click All services and click EC2 under Compute.
Select Auto Scaling Groups.
Click Edit for each Auto Scaling Group.
Check the Tag new instances Box for the Auto Scaling Group.
Click Update.
Repeat Steps 1-6 for each AWS Region used.

AWS CLI

Run aws autoscaling create-or-update-tags for tags that are not set to PropogateAtLaunch for each Auto Scaling Group that does not have this property set to true.

aws autoscaling create-or-update-tags \
--tags ResourceId=example-autoscaling-group,ResourceType=auto-scaling-
group,Key=TagKey,Value=TagValue,PropagateAtLaunch=true

Repeat Step 1 for each AWS Region used.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.cis_compute_service_v100_2_14

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.cis_compute_service_v100_2_14 --share

SQL

This control uses a named query:

with propagate_tags_to_ec2_instance as (
  select
    autoscaling_group_arn,
    count(*) as count
  from
    aws_ec2_autoscaling_group,
    jsonb_array_elements(tags_src) as t
  where
    (t ->> 'PropagateAtLaunch' = 'false')
  group by
    autoscaling_group_arn
)
select
  p.autoscaling_group_arn as resource,
  case
    when count > 0 then 'alarm'
    else 'ok'
  end as status,
  case
    when count > 0 then title || ' does not propagate all tags to the EC2 instance'
    else title || ' propagate all tags to the EC2 instance.'
  end as reason
  
  , region, account_id
from
  aws_ec2_autoscaling_group as p
  left join propagate_tags_to_ec2_instance as i on  i.autoscaling_group_arn = p.autoscaling_group_arn;