bug: Auto Scaling rejects comma-space subnet IDs accepted by AWS (Pro dev105)

[AndreKurait]

LocalStack rejects a comma-space subnet list in CreateAutoScalingGroup, while live AWS accepts it and normalizes the stored list. The comma-only control succeeds on both.

Environment

• Unmodified localstack/localstack-pro:dev, version 2026.10.0.dev105, build 3a0ece14; Pro license activation verified.
• Exact linux/amd64 image: sha256:acec8be1241f45d56519b20746d0208041e331ad2913be1eb03fd8d582121a2d.
• Also reproduced on native linux/arm64: sha256:8f4da21eb967b43d53b3e2c66597979bc3bf58eaf6816295c3fa2b138f24b4e7.
• Both are from dev image index sha256:b38e4fcb56751f999637f3395fd9ef4a593a4b96b57887d9b62ce44c6f22b5aa, pulled 2026-10-12.
• Docker Desktop on an ARM Mac (AMD64 run under emulation), EC2_VM_MANAGER=mock, no DynamoDB provider overrides, extensions, or source patches.
• Region us-east-1, boto3 1.43.111. ARM comparison: 2026-10-12 16:44:05–16:44:09 UTC; exact AMD64 comparison: 16:47:07–16:47:12 UTC. Same outcomes on both architectures.

Observed versus expected

Two existing subnets in the same VPC, in us-east-1a and us-east-1b, are passed with the matching explicit AvailabilityZones and the same launch-template version. Min/max/desired capacity are all zero; no instances are launched.

VPCZoneIdentifier	Live AWS	LocalStack
subnet-a, subnet-b	Create succeeds; stored value is subnet-a,subnet-b	HTTP 400 InvalidSubnetID.NotFound
subnet-a,subnet-b	Create succeeds	Create succeeds

LocalStack treats the literal leading space as part of the second subnet ID, for example:

The subnet ID ' subnet-49a2c73f21fcfef77' does not exist

The live AWS baseline ran in us-east-1 on 2026-10-12 at 15:58:25–15:58:35 UTC, using real EC2/Auto Scaling APIs and temporary resources. Both creates succeeded. All fields returned by DescribeAutoScalingGroups matched after excluding only group name, ARN, and creation time; both VPCZoneIdentifier values were comma-only. This is an observed creation/configuration difference, not a test of instance placement or launching.

Expected: accept the comma-space form, trim delimiter whitespace before subnet lookup, and return the normalized subnet list as AWS does.

Minimal reproducer

Start a disposable container with your own auth token set in the environment:

docker run --rm --name localstack-compat-repro \
  --platform linux/amd64 \
  -p 127.0.0.1:14566:4566 \
  -e LOCALSTACK_AUTH_TOKEN \
  -e EC2_VM_MANAGER=mock \
  localstack/localstack-pro@sha256:acec8be1241f45d56519b20746d0208041e331ad2913be1eb03fd8d582121a2d

After readiness, install boto3 and run the script below. This standalone reproducer was executed against the exact AMD64 image above. All AWS credentials are dummy values and the endpoint is loopback LocalStack. Fixtures are cleaned up.

The virtual AMI below is an emulator fixture for the mock VM manager; it must not be used as an AWS launch image.

"""LocalStack-only reproducer. Uses fake AWS credentials and creates no instances."""
import json
import uuid

import boto3
from botocore.config import Config
from botocore.exceptions import ClientError

options = dict(
    endpoint_url="http://127.0.0.1:14566",
    region_name="us-east-1",
    aws_access_key_id="test",
    aws_secret_access_key="test",
    config=Config(retries={"max_attempts": 0}, proxies={}),
)
ec2, asg, ddb = [boto3.client(name, **options) for name in ("ec2", "autoscaling", "dynamodb")]
name = "compat-repro-" + uuid.uuid4().hex[:8]


def record(label, call):
    try:
        value = call()
        print(json.dumps({"case": label, "result": value}, default=str))
        return True
    except ClientError as error:
        print(json.dumps({"case": label, "error": error.response["Error"]}))
        return False


# ASG: all inputs identical except group name and the comma-space delimiter.
vpc = ec2.create_vpc(CidrBlock="10.98.0.0/16")["Vpc"]["VpcId"]
subnets = [
    ec2.create_subnet(
        VpcId=vpc, CidrBlock=f"10.98.{index}.0/24", AvailabilityZone=zone
    )["Subnet"]["SubnetId"]
    for index, zone in enumerate(["us-east-1a", "us-east-1b"])
]
ami = ec2.register_image(Name=name, Architecture="x86_64", RootDeviceName="/dev/sda1")["ImageId"]
template = ec2.create_launch_template(
    LaunchTemplateName=name, LaunchTemplateData={"ImageId": ami, "InstanceType": "t3.micro"}
)["LaunchTemplate"]["LaunchTemplateId"]
groups = []
try:
    for label, delimiter in [("space", ", "), ("no-space", ",")]:
        group = name + "-" + label
        ok = record("asg-" + label, lambda: asg.create_auto_scaling_group(
            AutoScalingGroupName=group, MinSize=0, MaxSize=0, DesiredCapacity=0,
            AvailabilityZones=["us-east-1a", "us-east-1b"],
            LaunchTemplate={"LaunchTemplateId": template, "Version": "1"},
            VPCZoneIdentifier=delimiter.join(subnets),
        ))
        if ok:
            groups.append(group)
            record("asg-readback-" + label, lambda: asg.describe_auto_scaling_groups(
                AutoScalingGroupNames=[group]
            )["AutoScalingGroups"][0]["VPCZoneIdentifier"])
finally:
    for group in groups:
        asg.delete_auto_scaling_group(AutoScalingGroupName=group, ForceDelete=True)
    ec2.delete_launch_template(LaunchTemplateId=template)
    ec2.deregister_image(ImageId=ami)
    for subnet in subnets:
        ec2.delete_subnet(SubnetId=subnet)
    ec2.delete_vpc(VpcId=vpc)

On the affected image, asg-space fails and asg-no-space succeeds. The latter's readback returns the comma-only list.

Related DynamoDB parity findings from the same validation are tracked separately: https://github.com/orgs/localstack/discussions/78 and https://github.com/orgs/localstack/discussions/79.

[EddEcho]

Hi @AndreKurait thanks for the detailed report and reproducer. We were able to reproduce the issue on our latest dev build and confirmed AWS accepts these values, so it’s now with our engineering team for review. We’ll update this thread once a fix is available so you can test it.