bug: Auto Scaling instances lose the IAM profile inherited from a launch template

[AndreKurait]

Auto Scaling instances lose IamInstanceProfile inherited from a launch template, although the IAM profile exists and an explicit profile on a direct RunInstances call works.

Tested on unmodified localstack/localstack-pro:dev, resolved 2026-10-10:

• Manifest: sha256:513f218caf22d1fcb115f055225c96c7140813efcb23e48c9e24b688cdb31cd4
• Native linux/amd64 image: sha256:b104c9b43442fba4e1e00ab68c447681b08db6dc6128273d105e1db5c87e5ab3
• EC2_VM_MANAGER=mock, public EC2/Auto Scaling/IAM APIs, no extensions or patches.

Expected: both instances in each two-instance ASG expose the selected profile ARN in DescribeInstances, for both launch-template IamInstanceProfile.Name and .Arn forms.

Observed: both ASG instances omit IamInstanceProfile in each form. The explicit-profile direct-launch controls expose the correct ARN. Profile loss prevents a guest metadata provider from discovering the intended instance role; this report's standalone reproduction establishes the API metadata defect, not a production AWS comparison or a full guest test.

Run against a disposable LocalStack container at port 4566:

import json
import uuid
import boto3
from botocore.config import Config

options = dict(endpoint_url="http://127.0.0.1:4566", region_name="us-east-1",
               aws_access_key_id="000000000000", aws_secret_access_key="test",
               config=Config(retries={"max_attempts": 0}, proxies={}))
ec2, asg, iam = [boto3.client(service, **options)
                 for service in ("ec2", "autoscaling", "iam")]
name = "template-profile-repro-" + uuid.uuid4().hex[:8]
iam.create_role(RoleName=name, AssumeRolePolicyDocument=json.dumps({
    "Version": "2012-10-17", "Statement": [{"Effect": "Allow",
    "Principal": {"Service": "ec2.amazonaws.com"}, "Action": "sts:AssumeRole"}]}))
profile = iam.create_instance_profile(InstanceProfileName=name)["InstanceProfile"]
iam.add_role_to_instance_profile(InstanceProfileName=name, RoleName=name)
ami = ec2.register_image(Name=name, Architecture="x86_64", RootDeviceName="/dev/sda1")["ImageId"]
vpc = ec2.create_vpc(CidrBlock="10.85.0.0/16")["Vpc"]["VpcId"]
subnet = ec2.create_subnet(VpcId=vpc, CidrBlock="10.85.1.0/24")["Subnet"]["SubnetId"]
report = {"cases": []}
for form, value in (("Name", name), ("Arn", profile["Arn"])):
    lt = ec2.create_launch_template(LaunchTemplateName=name + "-" + form,
        LaunchTemplateData={"ImageId": ami, "InstanceType": "t3.micro",
                            "IamInstanceProfile": {form: value}})["LaunchTemplate"]["LaunchTemplateId"]
    direct = ec2.run_instances(MinCount=1, MaxCount=1, SubnetId=subnet,
        LaunchTemplate={"LaunchTemplateId": lt, "Version": "1"},
        IamInstanceProfile={form: value})["Instances"][0]["InstanceId"]
    asg.create_auto_scaling_group(AutoScalingGroupName=name + "-" + form,
        MinSize=2, MaxSize=2, DesiredCapacity=2, VPCZoneIdentifier=subnet,
        LaunchTemplate={"LaunchTemplateId": lt, "Version": "1"})
    ids = [row["InstanceId"] for row in asg.describe_auto_scaling_groups(
        AutoScalingGroupNames=[name + "-" + form])["AutoScalingGroups"][0]["Instances"]]
    assert len(ids) == 2
    for label, instance_id in [("explicit-direct", direct)] + [("asg", i) for i in ids]:
        instance = ec2.describe_instances(InstanceIds=[instance_id])["Reservations"][0]["Instances"][0]
        actual = instance.get("IamInstanceProfile", {}).get("Arn")
        report["cases"].append({"name": form + "-" + label,
            "status": "PASS" if actual == profile["Arn"] else "FAIL",
            "expected_arn": profile["Arn"], "actual_arn": actual})
print(json.dumps(report, indent=2))

The virtual AMI above is for LocalStack's mock VM manager. This script must not target AWS. Remove the disposable container to remove its fixture resources. All credentials and account IDs in the script are dummy values.

The output contains two passing explicit direct-launch controls and four failing ASG profile observations. The same profile also needs to be visible in the native EC2 instance-profile association API. In the installed public Moto model, the template profile appears not to be inherited through the ASG-to-EC2 backend call; resolving it with native account/partition validation and attaching it through the native association operation restores the API behavior in a separate component check. Keeping that ownership in the native model would avoid downstream metadata workarounds.

[AndreKurait]

Retested on 2026-10-10 against unmodified localstack/localstack-pro:dev, reporting Pro 2026.10.0.dev101 on Linux x86_64. This still reproduces.

All ten Auto Scaling instances across profile Name/Arn and explicit version 2, $Latest, and $Default template selection still lack the inherited instance profile. Direct RunInstances controls pass. The unknown-profile and foreign-account-profile cases also allocate instances instead of refusing without allocation. This uses the EC2 mock VM manager and checks the public API/model result, not guest credential delivery.

Resolved image index: sha256:a9b3e374db5310d706c6676a498f22b2b33a45a110ec79dbd7c41f07209c7e28; amd64 image ID: sha256:9581779d9198ddfa6f1a300760edaf7f28052eb2cfdd8f713bb528b186e0cbcc. Public SDK requests only, with no source patches or extensions. Disposable resources and the container were cleaned up afterward.

[EddEcho]

Hi @AndreKurait Thanks for the report and reproducer. We were able to reproduce both behaviors on our latest dev build: the instance profile isn’t inherited from the launch template, and invalid profiles aren’t rejected. It’s now with our engineering team for review. We’ll update this thread once a fix is available so you can test it.