Security Group Name Prefixed With launch-wizard Should Not Be Used

Using Console

Here are the step by step instructions to remediate the “Security Group Name Prefixed With launch-wizard Should Not Be Used” misconfiguration in AWS using the AWS console:

Log in to the AWS Management Console.
Go to the EC2 Dashboard.
Click on the “Security Groups” option in the left-hand menu.
Identify the security group(s) that have a name prefixed with “launch-wizard”.
Select the security group(s) that need to be remediated.
Click on the “Actions” button, and then select “Edit Group Name”.
Rename the security group(s) to a more descriptive and meaningful name that does not include the “launch-wizard” prefix.
Click on the “Save” button to save the changes.

Once you have completed these steps, the security group(s) will no longer have a name prefixed with “launch-wizard”, and the misconfiguration will be remediated.

Using CLI

To remediate the misconfiguration “Security Group Name Prefixed With launch-wizard Should Not Be Used” for AWS using AWS CLI, follow these steps:

Open the AWS CLI on your local machine or on the AWS EC2 instance.
Run the following command to list all the security groups in your account:
aws ec2 describe-security-groups
Identify the security group that has a name prefixed with “launch-wizard”.
Run the following command to rename the security group:
aws ec2 update-security-group-name --group-id <security-group-id> --group-name <new-security-group-name>
Replace <security-group-id> with the ID of the security group that you want to rename, and <new-security-group-name> with a new name for the security group that does not have “launch-wizard” prefix. For example:
aws ec2 update-security-group-name --group-id sg-0123456789abcdef0 --group-name my-security-group
Verify that the security group has been renamed successfully by running the following command:
aws ec2 describe-security-groups --group-ids <security-group-id>
Replace <security-group-id> with the ID of the security group that you have renamed. The output should show the new name of the security group.

Using Python

To remediate the security group name prefixed with launch-wizard in AWS using Python, you can follow the below steps:

Import the required modules:

import boto3

Connect to the AWS account:

client = boto3.client('ec2')

Get all the security groups:

response = client.describe_security_groups()

Loop through all the security groups and check if the name is prefixed with launch-wizard:

for sg in response['SecurityGroups']:
    if sg['GroupName'].startswith('launch-wizard'):
        # Delete the security group
        client.delete_security_group(GroupId=sg['GroupId'])

The above code will delete all the security groups that have a name prefixed with launch-wizard. If you want to rename the security group, you can use the below code:

for sg in response['SecurityGroups']:
    if sg['GroupName'].startswith('launch-wizard'):
        new_name = sg['GroupName'].replace('launch-wizard', 'new-name')
        # Rename the security group
        client.update_security_group_name_description(GroupId=sg['GroupId'], GroupName=new_name, Description='New Description')

The above code will rename all the security groups that have a name prefixed with launch-wizard to new-name. You can also update the description of the security group as per your requirement.

Note: Before deleting or renaming the security group, make sure that it is not being used by any instances or services.

Using Terraform

# New, properly named security group to replace the old "launch-wizard" group
resource "aws_security_group" "APP_SG" {
  name        = "APP_SECURITY_GROUP_NAME"        # e.g. "app-web-sg"
  description = "Security group for APP_DESCRIPTION"
  vpc_id      = "VPC_ID"                         # substitute your VPC ID

  # Recreate the needed rules from the old launch-wizard group (adjust as required)
  ingress {
    description = "APP_INGRESS_DESCRIPTION"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    description = "APP_EGRESS_DESCRIPTION"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "APP_SECURITY_GROUP_TAG_NAME"         # e.g. "app-web-sg"
  }
}

# Example: update an EC2 instance that was previously using the launch-wizard group
resource "aws_instance" "APP_INSTANCE" {
  ami           = "AMI_ID"                       # substitute an appropriate AMI
  instance_type = "INSTANCE_TYPE"                # e.g. "t3.micro"
  subnet_id     = "SUBNET_ID"

  # Replace the old "launch-wizard-*" SG ID with the new one
  vpc_security_group_ids = [
    aws_security_group.APP_SG.id,
    # add any other existing security group IDs that should remain attached
  ]

  tags = {
    Name = "APP_INSTANCE_NAME"
  }
}

# IMPORTANT:
# - Remove the old launch-wizard security group resource from Terraform entirely,
#   e.g. delete any `aws_security_group` (or data) block whose `name` was "launch-wizard-*".
# - If the old SG was not managed by Terraform (created by the console/Launch Wizard),
#   do NOT add it as a resource; instead, after all instances/ENIs are using `aws_security_group.APP_SG`,
#   delete the old SG manually or let an external process remove it.

# Deleting the launch-wizard security group is destructive and irreversible.
# Ensure all ENIs/instances have been migrated to the new group before removing
# the old SG from Terraform state or deleting it in AWS.

Applying this change will cause terraform plan to show:

A new aws_security_group being created with the non–launch-wizard name.
All affected aws_instance (or ENI-attaching resources) updated in-place to use the new security group ID.
The old launch-wizard security group being destroyed (if it was previously managed by Terraform and you removed its resource block).

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Security Group Name Prefixed With launch-wizard Should Not Be Used

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: