Autoscaling launch config hop limit remediation

Using Console

To remediate the “Autoscaling Hop Limit Should Be Checked” misconfiguration for AWS EC2 using the AWS console, follow these steps:

Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and login with your credentials.
Navigate to EC2 Dashboard: Click on the “Services” dropdown menu at the top left corner and select “EC2” under the Compute section.
Select Auto Scaling Groups: In the EC2 Dashboard, locate and click on “Auto Scaling Groups” from the navigation pane on the left.
Select the Auto Scaling Group: Identify the Auto Scaling Group that you want to remediate and click on its name to select it.
Edit Auto Scaling Group: In the Auto Scaling Group details page, click on the “Edit” button to modify the group settings.
Configure Auto Scaling Group: Scroll down to find the “Advanced Details” section and look for the “Instance Protection” settings.
Enable Instance Protection: In the “Instance Protection” settings, you should find an option related to “Autoscaling Hop Limit”. Enable this option by checking the box or setting an appropriate value based on your requirements.
Save Changes: Once you have enabled the Autoscaling Hop Limit or set the appropriate value, scroll to the bottom of the page and click on the “Save” button to apply the changes.
Verify Configuration: After saving the changes, it is recommended to verify that the Autoscaling Hop Limit setting has been successfully applied. You can do this by checking the configuration details of the Auto Scaling Group.

By following these steps, you can remediate the “Autoscaling Hop Limit Should Be Checked” misconfiguration for AWS EC2 using the AWS console.

Using CLI

To remediate the misconfiguration of Autoscaling Hop Limit not being checked for AWS EC2 using AWS CLI, follow these steps:

Open your terminal or command prompt.
Run the following AWS CLI command to describe the Auto Scaling groups in your AWS account:

aws autoscaling describe-auto-scaling-groups

Identify the Auto Scaling group that you want to update with the Autoscaling Hop Limit.
Run the following AWS CLI command to update the Auto Scaling group with the Autoscaling Hop Limit:

aws autoscaling update-auto-scaling-group --auto-scaling-group-name <your-auto-scaling-group-name> --health-check-type ELB --health-check-grace-period 300

Replace <your-auto-scaling-group-name> with the actual name of your Auto Scaling group.

Verify that the Autoscaling Hop Limit has been successfully updated by running the following AWS CLI command:

aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names <your-auto-scaling-group-name> --query "AutoScalingGroups[].HealthCheckType"

Replace <your-auto-scaling-group-name> with the actual name of your Auto Scaling group.

Ensure that the output of the above command shows “ELB” as the HealthCheckType, which indicates that the Autoscaling Hop Limit has been successfully updated.

By following these steps, you can remediate the misconfiguration of Autoscaling Hop Limit not being checked for AWS EC2 using AWS CLI.

Using Python

To remediate the “Autoscaling Hop Limit Should Be Checked” misconfiguration for AWS EC2 using Python, you can use the AWS SDK for Python (Boto3) to update the Auto Scaling Group settings. Here are the step-by-step instructions:

Install Boto3:

pip install boto3

Use the following Python script to update the Auto Scaling Group settings to check the “Autoscaling Hop Limit”:

import boto3

# Initialize the Boto3 client for Auto Scaling
client = boto3.client('autoscaling')

# Specify the name of the Auto Scaling Group you want to update
auto_scaling_group_name = 'YOUR_AUTO_SCALING_GROUP_NAME'

# Update the Auto Scaling Group to check the "Autoscaling Hop Limit"
response = client.update_auto_scaling_group(
    AutoScalingGroupName=auto_scaling_group_name,
    NewInstancesProtectedFromScaleIn=True
)

print(f"Auto Scaling Group {auto_scaling_group_name} updated successfully to check Autoscaling Hop Limit.")

Replace 'YOUR_AUTO_SCALING_GROUP_NAME' with the name of your Auto Scaling Group.
Run the Python script to update the Auto Scaling Group settings. This will enable the “Autoscaling Hop Limit” check for the specified Auto Scaling Group.

By following these steps, you can remediate the “Autoscaling Hop Limit Should Be Checked” misconfiguration for AWS EC2 using Python and Boto3.

Using Terraform

resource "aws_launch_configuration" "ASG_LAUNCH_CONFIGURATION" {
  name_prefix   = "ASG_LC_REMEDIATED-"            # substitute: a suitable prefix, or hard-code a name if required
  image_id      = "AMI_ID"                        # substitute: existing launch configuration AMI ID
  instance_type = "INSTANCE_TYPE"                 # substitute: existing launch configuration instance type

  # Copy ALL other settings from the existing launch configuration:
  # security_groups      = [SECURITY_GROUP_IDS]
  # iam_instance_profile = "IAM_INSTANCE_PROFILE_NAME"
  # user_data            = file("USER_DATA_SCRIPT.sh")
  # key_name             = "KEY_PAIR_NAME"
  # associate_public_ip_address = true
  # ebs_optimized        = true
  # root_block_device { ... }
  # ebs_block_device  { ... }
  # etc.

  metadata_options {
    http_put_response_hop_limit = 1
    http_tokens                 = "required"
  }

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_autoscaling_group" "ASG" {
  name                      = "ASG_NAME"     # substitute: existing ASG name (or let Terraform manage it)
  launch_configuration      = aws_launch_configuration.ASG_LAUNCH_CONFIGURATION.name
  min_size                  = 1              # substitute existing values
  max_size                  = 3
  desired_capacity          = 2
  vpc_zone_identifier       = ["SUBNET_ID_1", "SUBNET_ID_2"] # substitute existing subnets

  # Copy all other existing ASG settings:
  # health_check_type       = "EC2"
  # health_check_grace_period = 300
  # target_group_arns       = [TARGET_GROUP_ARNS]
  # termination_policies    = [...]
  # etc.

  tag {
    key                 = "Name"
    value               = "ASG_INSTANCE_NAME"
    propagate_at_launch = true
  }
}

Changing metadata_options on aws_launch_configuration forces replacement of the launch configuration; with create_before_destroy = true, Terraform will create the new configuration and then switch the Auto Scaling Group to it (instances may then be replaced according to your ASG settings).For verification, terraform plan should show a new aws_launch_configuration being created (and the old one destroyed) and the aws_autoscaling_group updated to reference the new launch configuration, with http_put_response_hop_limit = 1 and http_tokens = "required" in the plan.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Autoscaling launch config hop limit remediation

Triage and Remediation

Remediation

​Triage and Remediation

​Remediation

​

Triage and Remediation

Remediation