cis-aws-compute-2-14

name	cis-aws-compute-2.14
description	Ensure EC2 Auto Scaling Groups Propagate Tags to EC2 Instances that it launches
category	cis-compute
version	1.1.0
author	cyberstrike-official
tags	["cis","aws","compute","ec2","auto-scaling","tags","propagation","compliance"]
cis_id	2.14
cis_benchmark	CIS AWS Compute Services Benchmark v1.1.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-compute-2.3","cis-aws-compute-2.4"]
prerequisites	[]
severity_boost	{}

Ensure EC2 Auto Scaling Groups Propagate Tags to EC2 Instances that it launches

Description

Tags can help with managing, identifying, organizing, searching for, and filtering resources. Additionally, tags can help with security and compliance. Tags can be propagated from an Auto Scaling group to the EC2 instances that it launches.

Rationale

Without tags, EC2 instances created via Auto Scaling can be without tags and could be out of compliance with security policy.

Impact

No negative impact. Enabling tag propagation ensures all instances launched by Auto Scaling groups inherit the group's tags automatically.

Audit Procedure

Using AWS CLI

1. Run aws autoscaling describe-auto-scaling-groups:

aws autoscaling describe-auto-scaling-groups

2. Ensure PropagateAtLaunch is true under Tags for each Tag for the Auto Scaling Group.
3. Repeat Steps 1-2 for each AWS Region used.

Using AWS Console

1. Login to AWS Console using https://console.aws.amazon.com
2. Click All services and click EC2 under Compute.
3. Select Auto Scaling Groups.
4. For each Auto Scaling Group's Details, ensure that all tags have Tag new instances set to Yes.
5. Repeat Steps 1-4 for each AWS Region used.

Expected Result

All tags in every Auto Scaling Group should have PropagateAtLaunch set to true. In the console, all tags should show Tag new instances set to Yes.

Remediation

Using AWS CLI

No specific CLI remediation command is provided for this control. Use the console method below.

Using AWS Console

1. Login to AWS Console using https://console.aws.amazon.com
2. Click All services and click EC2 under Compute.
3. Select Auto Scaling Groups.
4. Click Edit for each Auto Scaling Group.
5. Check the Tag new instances Box for the Auto Scaling Group.
6. Click Update.
7. Repeat Steps 1-6 for each AWS Region used.

Default Value

By default, Auto Scaling group tags are not automatically propagated to launched instances unless is set to .