Skip to main content

Security Group Name Prefixed With launch-wizard Should Not

More Info:​

EC2 security groups prefixed with launch-wizard should not be in use in order to follow AWS security best practices.

Risk Level​

Low

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Here are the step by step instructions to remediate the "Security Group Name Prefixed With launch-wizard Should Not Be Used" misconfiguration in AWS using the AWS console:

  1. Log in to the AWS Management Console.
  2. Go to the EC2 Dashboard.
  3. Click on the "Security Groups" option in the left-hand menu.
  4. Identify the security group(s) that have a name prefixed with "launch-wizard".
  5. Select the security group(s) that need to be remediated.
  6. Click on the "Actions" button, and then select "Edit Group Name".
  7. Rename the security group(s) to a more descriptive and meaningful name that does not include the "launch-wizard" prefix.
  8. Click on the "Save" button to save the changes.

Once you have completed these steps, the security group(s) will no longer have a name prefixed with "launch-wizard", and the misconfiguration will be remediated.

Using CLI

To remediate the misconfiguration "Security Group Name Prefixed With launch-wizard Should Not Be Used" for AWS using AWS CLI, follow these steps:

  1. Open the AWS CLI on your local machine or on the AWS EC2 instance.

  2. Run the following command to list all the security groups in your account:

    aws ec2 describe-security-groups

  3. Identify the security group that has a name prefixed with "launch-wizard".

  4. Run the following command to rename the security group:

    aws ec2 update-security-group-name --group-id <security-group-id> --group-name <new-security-group-name>

    Replace <security-group-id> with the ID of the security group that you want to rename, and <new-security-group-name> with a new name for the security group that does not have "launch-wizard" prefix.

    For example:

    aws ec2 update-security-group-name --group-id sg-0123456789abcdef0 --group-name my-security-group

  5. Verify that the security group has been renamed successfully by running the following command:

    aws ec2 describe-security-groups --group-ids <security-group-id>

    Replace <security-group-id> with the ID of the security group that you have renamed.

    The output should show the new name of the security group.

Using Python

To remediate the security group name prefixed with launch-wizard in AWS using Python, you can follow the below steps:

  1. Import the required modules:
import boto3
  1. Connect to the AWS account:
client = boto3.client('ec2')
  1. Get all the security groups:
response = client.describe_security_groups()
  1. Loop through all the security groups and check if the name is prefixed with launch-wizard:
for sg in response['SecurityGroups']:
    if sg['GroupName'].startswith('launch-wizard'):
        # Delete the security group
        client.delete_security_group(GroupId=sg['GroupId'])
  1. The above code will delete all the security groups that have a name prefixed with launch-wizard. If you want to rename the security group, you can use the below code:
for sg in response['SecurityGroups']:
    if sg['GroupName'].startswith('launch-wizard'):
        new_name = sg['GroupName'].replace('launch-wizard', 'new-name')
        # Rename the security group
        client.update_security_group_name_description(GroupId=sg['GroupId'], GroupName=new_name, Description='New Description')
  1. The above code will rename all the security groups that have a name prefixed with launch-wizard to new-name. You can also update the description of the security group as per your requirement.

Note: Before deleting or renaming the security group, make sure that it is not being used by any instances or services.

Using Terraform
# New, properly named security group to replace the old "launch-wizard" group
resource "aws_security_group" "APP_SG" {
  name        = "APP_SECURITY_GROUP_NAME"        # e.g. "app-web-sg"
  description = "Security group for APP_DESCRIPTION"
  vpc_id      = "VPC_ID"                         # substitute your VPC ID

  # Recreate the needed rules from the old launch-wizard group (adjust as required)
  ingress {
    description = "APP_INGRESS_DESCRIPTION"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    description = "APP_EGRESS_DESCRIPTION"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "APP_SECURITY_GROUP_TAG_NAME"         # e.g. "app-web-sg"
  }
}

# Example: update an EC2 instance that was previously using the launch-wizard group
resource "aws_instance" "APP_INSTANCE" {
  ami           = "AMI_ID"                       # substitute an appropriate AMI
  instance_type = "INSTANCE_TYPE"                # e.g. "t3.micro"
  subnet_id     = "SUBNET_ID"

  # Replace the old "launch-wizard-*" SG ID with the new one
  vpc_security_group_ids = [
    aws_security_group.APP_SG.id,
    # add any other existing security group IDs that should remain attached
  ]

  tags = {
    Name = "APP_INSTANCE_NAME"
  }
}

# IMPORTANT:
# - Remove the old launch-wizard security group resource from Terraform entirely,
#   e.g. delete any `aws_security_group` (or data) block whose `name` was "launch-wizard-*".
# - If the old SG was not managed by Terraform (created by the console/Launch Wizard),
#   do NOT add it as a resource; instead, after all instances/ENIs are using `aws_security_group.APP_SG`,
#   delete the old SG manually or let an external process remove it.

# Deleting the launch-wizard security group is destructive and irreversible.
# Ensure all ENIs/instances have been migrated to the new group before removing
# the old SG from Terraform state or deleting it in AWS.

Applying this change will cause terraform plan to show:

  • A new aws_security_group being created with the non–launch-wizard name.
  • All affected aws_instance (or ENI-attaching resources) updated in-place to use the new security group ID.
  • The old launch-wizard security group being destroyed (if it was previously managed by Terraform and you removed its resource block).

Additional Reading:​