AWS Launch Templates — Complete Reference¶

Without LT:                        With LT:
Every launch: select AMI           Define once → reference everywhere
             choose type    →      ASG, Spot Fleet, EC2 Fleet all reuse it
             set network           Version it → safe updates + rollback
             add SG
             add user data
             (error-prone, slow)

AMI = WHAT the machine looks like (disk state, OS, software)
Launch Template = HOW to run the machine (network, size, security, scripts)

Production launch:
  AMI: ami-0c55b159cbfafe1f0  (Ubuntu 24.04 + Nginx pre-installed)
    ↓ referenced inside ↓
  Launch Template v3: t3.medium, sg-app, iam-web-role, user_data.sh
    ↓ used by ↓
  Auto Scaling Group: min=2, max=10, desired=3

v1: AMI=ami-abc, type=t2.micro, sg=sg-old    ← original
v2: AMI=ami-abc, type=t3.micro, sg=sg-old    ← instance type upgrade
v3: AMI=ami-xyz, type=t3.micro, sg=sg-new    ← new AMI + new SG

LT v2 → v3 (new AMI with security patch)
  ↓
Instance Refresh launched:
  Phase 1: Launch new instances (v3), wait for health check ✅
  Phase 2: Terminate old instances (v2)
  Phase 3: Repeat until all instances run v3
  (configurable: min healthy %, warmup time, checkpoint)

Auto Scaling Group:
  Launch Template: base (defines AMI, networking, SG, user data)
  Mixed Instances Policy:
    On-Demand base: 2             ← always keep 2 On-Demand (guaranteed)
    On-Demand percentage: 20%     ← 20% of scaling = On-Demand, 80% = Spot
    Instance overrides:
      - InstanceType: t3.large    (primary)
      - InstanceType: t3a.large   (fallback)
      - InstanceType: m5.large    (fallback)
      - InstanceType: m5a.large   (fallback)

IMDSv1 (vulnerable):
  curl http://169.254.169.254/latest/meta-data/iam/security-credentials/my-role
  → Returns credentials (any code/SSRF can do this) ❌

IMDSv2 (secure):
  TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" \
          -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
  curl http://169.254.169.254/latest/meta-data/... \
       -H "X-aws-ec2-metadata-token: $TOKEN"
  → Only code that can send PUT first gets the token ✅

Metadata options:
  IMDSv2: Required (httpTokens = required)
  Hop limit: 1  (prevents container-to-host metadata access)

#!/bin/bash
set -euo pipefail

# Install Python
apt-get update -y
DEBIAN_FRONTEND=noninteractive apt-get install -y python3

# Write the app
cat >/home/ubuntu/server.py <<'PY'
from http.server import BaseHTTPRequestHandler, HTTPServer

class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        if self.path == "/health":
            self.send_response(200)
            self.send_header("Content-type", "text/plain")
            self.end_headers()
            self.wfile.write(b"ok\n")
            return

        self.send_response(200)
        self.send_header("Content-type", "text/plain")
        self.end_headers()
        self.wfile.write(
            b"Between every heartbeat, I secretly say your name, Sweetheart Ibtisam\n"
)

HTTPServer(("0.0.0.0", 8080), Handler).serve_forever()
PY

chown ubuntu:ubuntu /home/ubuntu/server.py

# Create systemd service
cat >/etc/systemd/system/pyserver.service <<'UNIT'
[Unit]
Description=Python HTTP Server on port 8080
After=network.target

[Service]
User=ubuntu
ExecStart=/usr/bin/python3 /home/ubuntu/server.py
Restart=always
RestartSec=5
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target
UNIT

# Enable and start
systemctl daemon-reload
systemctl enable pyserver
systemctl start pyserver

AMI: Ubuntu + Nginx + Java (pre-installed, tested)
User data: pulls latest app version from S3, writes environment config
Result: launch time = ~30 seconds (no package installs)

Step 1: Create custom AMI
  - Launch base EC2
  - Install: Nginx, Node.js, dependencies
  - Test
  - Actions → Create Image → ami-custom-webapp

Step 2: Create Launch Template
  Name: webapp-lt
  AMI: ami-custom-webapp
  Instance type: t3.medium
  Security Group: sg-webapp (allow 80, 443 from ALB)
  IAM role: ec2-webapp-role (S3 read, Secrets Manager read)
  IMDSv2: Required
  User data:
    #!/bin/bash
    SECRET=$(aws secretsmanager get-secret-value --secret-id prod/db-password)
    echo "DB_PASSWORD=$SECRET" >> /etc/environment
    systemctl start webapp
  Tags: Env=Production, App=WebApp

Step 3: Create Auto Scaling Group
  Launch Template: webapp-lt $Default
  Min: 2, Max: 10, Desired: 3
  Target Group: webapp-tg (attached to ALB)
  Scaling Policy: target 60% CPU

Step 4: Update AMI (security patch needed)
  - Create new AMI with patch → ami-custom-webapp-v2
  - Create LT version 2: update AMI to ami-custom-webapp-v2
  - Set v2 as $Default
  - Start Instance Refresh on ASG → rolling replace ✅