bug: Auto Scaling ignores launch-template AssociatePublicIpAddress on the primary interface

[AndreKurait]

Auto Scaling drops the primary launch-template network interface's AssociatePublicIpAddress setting when creating an instance.

Tested with the unmodified localstack/localstack-pro:dev image resolved on 2026-10-10:

• Manifest: sha256:513f218caf22d1fcb115f055225c96c7140813efcb23e48c9e24b688cdb31cd4
• Native linux/amd64 image: sha256:b104c9b43442fba4e1e00ab68c447681b08db6dc6128273d105e1db5c87e5ab3
• EC2_VM_MANAGER=mock; EC2 and Auto Scaling APIs; no extensions or compatibility patches.

On a subnet with MapPublicIpOnLaunch=false, a direct RunInstances request with the same primary-interface setting returns a public IP, but an ASG using launch-template version 1 with AssociatePublicIpAddress=true returns an instance with no PublicIpAddress. Explicit false and omitted-setting controls return no public IP as expected.

Minimal reproduction against a disposable LocalStack container at port 4566:

import uuid
import boto3
from botocore.config import Config

options = dict(
    endpoint_url="http://localhost:4566",
    region_name="us-east-1",
    aws_access_key_id="000000000000",
    aws_secret_access_key="test",
    config=Config(retries={"max_attempts": 0}),
)
ec2 = boto3.client("ec2", **options)
asg = boto3.client("autoscaling", **options)
name = "public-ip-repro-" + uuid.uuid4().hex[:8]
ami = ec2.register_image(Name=name, Architecture="x86_64", RootDeviceName="/dev/sda1")["ImageId"]
vpc = ec2.create_vpc(CidrBlock="10.80.0.0/16")["Vpc"]["VpcId"]
subnet = ec2.create_subnet(VpcId=vpc, CidrBlock="10.80.1.0/24", AvailabilityZone="us-east-1a")["Subnet"]["SubnetId"]
ec2.modify_subnet_attribute(SubnetId=subnet, MapPublicIpOnLaunch={"Value": False})
group = ec2.create_security_group(VpcId=vpc, GroupName=name, Description="disposable repro")["GroupId"]
interface = {"DeviceIndex": 0, "Groups": [group], "AssociatePublicIpAddress": True}
template = ec2.create_launch_template(
    LaunchTemplateName=name,
    LaunchTemplateData={"ImageId": ami, "InstanceType": "t3.micro", "NetworkInterfaces": [interface]},
)["LaunchTemplate"]["LaunchTemplateId"]
direct = ec2.run_instances(
    ImageId=ami, InstanceType="t3.micro", MinCount=1, MaxCount=1,
    NetworkInterfaces=[dict(interface, SubnetId=subnet)],
)["Instances"][0]["InstanceId"]
asg.create_auto_scaling_group(
    AutoScalingGroupName=name, MinSize=1, MaxSize=1, DesiredCapacity=1,
    VPCZoneIdentifier=subnet,
    LaunchTemplate={"LaunchTemplateId": template, "Version": "1"},
)
group_instance = asg.describe_auto_scaling_groups(AutoScalingGroupNames=[name])["AutoScalingGroups"][0]["Instances"][0]["InstanceId"]
for label, instance_id in (("direct", direct), ("asg", group_instance)):
    instance = ec2.describe_instances(InstanceIds=[instance_id])["Reservations"][0]["Instances"][0]
    print(label, bool(instance.get("PublicIpAddress")))
# Observed: direct True; asg False. Expected: both True.

The virtual AMI in this example is intended for LocalStack's mock VM manager; this is not a script to run against AWS. Removing the disposable container removes its fixture resources.

Inspection of the installed public Moto model suggests the ASG launch path forwards the legacy launch-configuration association flag, while launch-template primary-interface association is not carried into instance creation. This report concerns API launch metadata, not public-address network reachability. No production AWS acceptance test is claimed.

[AndreKurait]

Retested on 2026-10-10 against unmodified localstack/localstack-pro:dev, reporting Pro 2026.10.0.dev101 on Linux x86_64. This still reproduces.

The launch-template AssociatePublicIpAddress=true case still produces an Auto Scaling instance without the requested public address. Direct RunInstances controls pass. This is an EC2 mock VM-manager API/model reproduction; it does not test real guest networking.

Resolved image index: sha256:a9b3e374db5310d706c6676a498f22b2b33a45a110ec79dbd7c41f07209c7e28; amd64 image ID: sha256:9581779d9198ddfa6f1a300760edaf7f28052eb2cfdd8f713bb528b186e0cbcc. Public SDK requests only, with no source patches or extensions. Disposable resources and the container were cleaned up afterward.

[AntonLage]

Hello @AndreKurait ,

Thanks for the detailed report. Thanks to it, I was able to easily reproduce the issue and escalated it to the engineering team to further work on it. I will let you know once it's fixed.