(@aws-ec2): Using require_imdsv2=True creates non-unique launch templates

[scottbisker]

What is the problem?

When creating an EC2 instance that has require_imdsv2=True, the module utilizes ASG Launch templates to enforce the IMDSv2 configuration by creating a Launch Template. The Launch Template name is identical to the ID parameter passed during the instance creation. If you have more than one stack in the same account/region that utilizes a standard code base where the id parameters are identical, the second stack will always fail to create complaining of duplicate Launch Template names.

Reproduction Steps

Attempt to deploy two stacks with bastion instances that incorporates this code.

Bastion EC2 Instance

    self.bastion_instance = ec2.Instance(self,"BastionInstance",
        instance_name = self.node.try_get_context(env_context)["BastionInternalHostname"], 
        instance_type = ec2.InstanceType(self.node.try_get_context(env_context)["BastionInstanceType"]),
        role = bastion_instance_role,
        machine_image = linux_images,
        require_imdsv2=True,
        vpc = self.vpc,
        vpc_subnets = ec2.SubnetSelection(subnet_type=ec2.SubnetType.PUBLIC),
        security_group = bastion_security_group,
        #user_data = ec2.UserData.custom(user_data_bastion),
        block_devices=[
            ec2.BlockDevice(
                device_name="/dev/sda1",
                volume=ec2.BlockDeviceVolume.ebs(
                    32,
                    encrypted=True,
                    volume_type=ec2.EbsDeviceVolumeType.GP3
                )
            )
        ],
    )

What did you expect to happen?

When the launch template is created it would prefix or suffix the Launch Template with stack unique identifiers to avoid duplicate names.

What actually happened?

The second stack attempted to create a Launch Template with an identical name.

BastionInstanceLaunchTemplate already exists in stack ......

CDK CLI Version

1.33.0

Framework Version

No response

Node.js Version

14.16.1

OS

MacOS

Language

Python

Language Version

Python 3.9

Other information

No response

[peterwoodworth]

The stacks creating resources with identical names is intentional! With the instance_name parameter, you are setting the physical name of the resource without any additional identifiers.

Let me know if this clears up the confusion

[scottbisker]

instance_name isn't the issue in this case. I understand that by setting instance_name, I'm setting the Name tag for the instant being created. The problem is that if you specify require_imdsv2=True, then a Launch Template is created to apply the IMDSv2 configuration. When the Launch Template is created, it is created using the second parameter "BastionInstance". It creates a Launch Template with the name "BastionInstanceLaunchTemplate". There should at least be a stack identifier applied to the Launch Template name to avoid possible duplication.

[peterwoodworth]

Ah I see, my apologies for misunderstanding.

This is the line that determines the launch template name:

aws-cdk/packages/@aws-cdk/aws-ec2/lib/aspects/require-imdsv2-aspect.ts

Line 86 in dd5e12d

const name = `${node.node.id}LaunchTemplate`;

@jericht @rix0rrr is there any reason to specify the physical name of the launch template?

aws-cdk/packages/@aws-cdk/aws-ec2/lib/aspects/require-imdsv2-aspect.ts

Line 93 in dd5e12d

launchTemplateName: name,

[jericht]

@peterwoodworth There is. In my testing, I noticed the CfnLaunchTemplate construct does not auto-generate a name for the launch template. Because of this, since Instance.launchTemplate requires either a LaunchTemplateId or LaunchTemplateName, we need to supply one when we create the launch template. I believe we can fix this by changing the launch template name to a unique ID generated with Names.uniqueId (ref).

I missed these use cases in my original implementation, so I'll make a PR to fix it.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.