bug: CloudFormation AWS::EC2::Instance drops Tags from the created instance

[AndreKurait]

AWS::EC2::Instance.Properties.Tags are present in the submitted template, but absent from the instance returned by DescribeInstances after the stack reaches CREATE_COMPLETE. A direct RunInstances control with equivalent TagSpecifications preserves both tags.

Tested with an unmodified localstack/localstack-pro:dev image on Linux amd64, resolved on 2026-10-21 to:

localstack/localstack-pro@sha256:722b9ef554f91eedf9416b4efb4d0581177073b7c890679594b6d52b3ee186e4

Image creation time: 2026-10-21T12:09:05.228977792Z. The reproduction uses EC2_VM_MANAGER=mock, no extensions, no initialization hooks, and no source patches. All AWS calls use the local endpoint and dummy credentials.

Start a disposable container with your own LocalStack Pro auth token:

docker run --rm -d --name cfn-ec2-repro \
  -e LOCALSTACK_AUTH_TOKEN \
  -e EC2_VM_MANAGER=mock \
  -e EC2_DOWNLOAD_DEFAULT_IMAGES=0 \
  -e LEGACY_DOCKER_CLIENT=1 \
  -e DNS_ADDRESS=0 \
  localstack/localstack-pro@sha256:722b9ef554f91eedf9416b4efb4d0581177073b7c890679594b6d52b3ee186e4

Then run the following script in that container. It selects an available x86_64 AMI and a default subnet with MapPublicIpOnLaunch=true, creates one direct EC2 instance and one CloudFormation-owned instance, compares the exact instance IDs, and removes both through the normal APIs.

docker exec -i cfn-ec2-repro /opt/code/localstack/.venv/bin/python - <<'PY'
"""Reproduce two CloudFormation EC2 discrepancies against stock LocalStack."""
import json
import time
import urllib.request
import uuid

import boto3
from botocore.config import Config

def client(service):
    return boto3.client(
        service, endpoint_url="http://127.0.0.1:4566", region_name="eu-west-1",
        aws_access_key_id="test", aws_secret_access_key="test",
        config=Config(connect_timeout=5, read_timeout=10, retries={"total_max_attempts": 1}),
    )

ec2, cfn = client("ec2"), client("cloudformation")
wait = {"Delay": 1, "MaxAttempts": 90}
deadline = time.monotonic() + 90
while True:
    try:
        with urllib.request.urlopen("http://127.0.0.1:4566/_localstack/health", timeout=2):
            break
    except OSError:
        if time.monotonic() >= deadline:
            raise
        time.sleep(0.5)

images = [image for page in ec2.get_paginator("describe_images").paginate(
    Owners=["amazon"], Filters=[
        {"Name": "state", "Values": ["available"]},
        {"Name": "architecture", "Values": ["x86_64"]},
    ]) for image in page["Images"]]
ami = min(images, key=lambda image: image["ImageId"])["ImageId"]
subnets = ec2.describe_subnets(Filters=[
    {"Name": "default-for-az", "Values": ["true"]},
])["Subnets"]
subnet = min((s for s in subnets if s["MapPublicIpOnLaunch"]),
             key=lambda s: s["SubnetId"])["SubnetId"]
case = 'tags'
name = "cfn-ec2-repro-" + uuid.uuid4().hex[:16]
properties = {"ImageId": ami, "InstanceType": "m5.large"}
direct = {"ImageId": ami, "InstanceType": "m5.large", "MinCount": 1, "MaxCount": 1}
if case == "tags":
    tags = [{"Key": "Name", "Value": "cfn-ec2-repro"},
            {"Key": "Reproduction", "Value": "true"}]
    properties.update(SubnetId=subnet, Tags=tags)
    direct.update(SubnetId=subnet, TagSpecifications=[
        {"ResourceType": "instance", "Tags": tags},
    ])
else:
    interface = {"DeviceIndex": 0, "SubnetId": subnet, "AssociatePublicIpAddress": False}
    properties["NetworkInterfaces"] = [{**interface, "DeviceIndex": "0"}]
    direct["NetworkInterfaces"] = [interface]
template = {"Resources": {"Instance": {
    "Type": "AWS::EC2::Instance", "Properties": properties,
}}}
direct_id, stack_id = None, None
try:
    direct_id = ec2.run_instances(**direct)["Instances"][0]["InstanceId"]
    stack_id = cfn.create_stack(StackName=name, TemplateBody=json.dumps(template))["StackId"]
    cfn.get_waiter("stack_create_complete").wait(StackName=stack_id, WaiterConfig=wait)
    cfn_id = cfn.describe_stack_resource(StackName=stack_id, LogicalResourceId="Instance")[
        "StackResourceDetail"]["PhysicalResourceId"]
    row = {"template": template, "subnet_is_public_by_default": True}
    for label, instance_id in (("direct", direct_id), ("cloudformation", cfn_id)):
        instance = ec2.describe_instances(InstanceIds=[instance_id])[
            "Reservations"][0]["Instances"][0]
        row[label] = {
            "state": instance["State"]["Name"],
            "subnet_matches": instance["SubnetId"] == subnet,
            "tags": {tag["Key"]: tag["Value"] for tag in instance.get("Tags", [])
                     if tag["Key"] in ("Name", "Reproduction")},
            "has_public_ipv4": bool(instance.get("PublicIpAddress")),
        }
    print(json.dumps({case: row}, indent=2), flush=True)
finally:
    if stack_id:
        cfn.delete_stack(StackName=stack_id)
        cfn.get_waiter("stack_delete_complete").wait(StackName=stack_id, WaiterConfig=wait)
    if direct_id:
        ec2.terminate_instances(InstanceIds=[direct_id])
        ec2.get_waiter("instance_terminated").wait(InstanceIds=[direct_id], WaiterConfig=wait)

PY

Expected

The instance created by CloudFormation should retain Name=cfn-ec2-repro and Reproduction=true, matching the direct EC2 control.

Observed

The direct instance has both requested tags. The CloudFormation-owned instance has neither requested tag. Both instances are running, and each observation uses the exact instance ID returned by its owning API. This comparison concerns the two explicit resource tags, not generated aws:cloudformation:* tags.

Focused result from the stock-image comparison:

{
  "direct": {
    "state": "running",
    "tags": {
      "Name": "cfn-ec2-repro",
      "Reproduction": "true"
    }
  },
  "cloudformation": {
    "state": "running",
    "tags": {}
  }
}

The reproduced instances and stacks were deleted through the ordinary EC2/CloudFormation APIs, and the disposable container was removed. To remove your reproduction container:

docker stop cfn-ec2-repro

[AndreKurait]

Retested the unchanged minimal reproduction on the unmodified localstack/localstack-pro:dev image observed on 2026-10-22 (Linux amd64):

• Manifest: sha256:606d6fe73cbebe61c76d552864a73fa85d7fbd62a651c35a35fc76977b7d26c3
• Image config: sha256:87d720cefbcc168cac5b7e361d7a110bfef30cb2d18a8645a303225bf9ae9614

Direct EC2 RunInstances honored the requested subnet, both instance tags, and AssociatePublicIpAddress: false; all nine control checks passed.

The equivalent CloudFormation AWS::EC2::Instance still selected a different subnet, omitted the Name and custom instance tags, and assigned a public IP. The same AMI and instance type were retained, with the expected owner, instance identity, and running state. The requested subnet had MapPublicIpOnLaunch: true, so the explicit interface-level public-IP setting matters.

This used the normal licensed entrypoint with no added extensions, adapters, or init scripts. The stack and both instances were deleted after the comparison. Successful execution and cleanup do not mean the CloudFormation checks passed.