bug: CloudFormation EC2 NetworkInterfaces ignores AssociatePublicIpAddress=false

[AndreKurait]

An AWS::EC2::Instance created with an inline primary NetworkInterfaces entry and AssociatePublicIpAddress: false still receives a public IPv4 address. A direct RunInstances control using the same subnet and interface flag receives no public address.

Tested with an unmodified localstack/localstack-pro:dev image on Linux amd64, resolved on 2026-10-21 to:

localstack/localstack-pro@sha256:722b9ef554f91eedf9416b4efb4d0581177073b7c890679594b6d52b3ee186e4

Image creation time: 2026-10-21T12:09:05.228977792Z. The reproduction uses EC2_VM_MANAGER=mock, no extensions, no initialization hooks, and no source patches. All AWS calls use the local endpoint and dummy credentials.

Start a disposable container with your own LocalStack Pro auth token:

docker run --rm -d --name cfn-ec2-repro \
  -e LOCALSTACK_AUTH_TOKEN \
  -e EC2_VM_MANAGER=mock \
  -e EC2_DOWNLOAD_DEFAULT_IMAGES=0 \
  -e LEGACY_DOCKER_CLIENT=1 \
  -e DNS_ADDRESS=0 \
  localstack/localstack-pro@sha256:722b9ef554f91eedf9416b4efb4d0581177073b7c890679594b6d52b3ee186e4

Then run the following script in that container. It selects an available x86_64 AMI and a default subnet with MapPublicIpOnLaunch=true, creates one direct EC2 instance and one CloudFormation-owned instance, compares the exact instance IDs, and removes both through the normal APIs.

docker exec -i cfn-ec2-repro /opt/code/localstack/.venv/bin/python - <<'PY'
"""Reproduce two CloudFormation EC2 discrepancies against stock LocalStack."""
import json
import time
import urllib.request
import uuid

import boto3
from botocore.config import Config

def client(service):
    return boto3.client(
        service, endpoint_url="http://127.0.0.1:4566", region_name="eu-west-1",
        aws_access_key_id="test", aws_secret_access_key="test",
        config=Config(connect_timeout=5, read_timeout=10, retries={"total_max_attempts": 1}),
    )

ec2, cfn = client("ec2"), client("cloudformation")
wait = {"Delay": 1, "MaxAttempts": 90}
deadline = time.monotonic() + 90
while True:
    try:
        with urllib.request.urlopen("http://127.0.0.1:4566/_localstack/health", timeout=2):
            break
    except OSError:
        if time.monotonic() >= deadline:
            raise
        time.sleep(0.5)

images = [image for page in ec2.get_paginator("describe_images").paginate(
    Owners=["amazon"], Filters=[
        {"Name": "state", "Values": ["available"]},
        {"Name": "architecture", "Values": ["x86_64"]},
    ]) for image in page["Images"]]
ami = min(images, key=lambda image: image["ImageId"])["ImageId"]
subnets = ec2.describe_subnets(Filters=[
    {"Name": "default-for-az", "Values": ["true"]},
])["Subnets"]
subnet = min((s for s in subnets if s["MapPublicIpOnLaunch"]),
             key=lambda s: s["SubnetId"])["SubnetId"]
case = 'public-ip'
name = "cfn-ec2-repro-" + uuid.uuid4().hex[:16]
properties = {"ImageId": ami, "InstanceType": "m5.large"}
direct = {"ImageId": ami, "InstanceType": "m5.large", "MinCount": 1, "MaxCount": 1}
if case == "tags":
    tags = [{"Key": "Name", "Value": "cfn-ec2-repro"},
            {"Key": "Reproduction", "Value": "true"}]
    properties.update(SubnetId=subnet, Tags=tags)
    direct.update(SubnetId=subnet, TagSpecifications=[
        {"ResourceType": "instance", "Tags": tags},
    ])
else:
    interface = {"DeviceIndex": 0, "SubnetId": subnet, "AssociatePublicIpAddress": False}
    properties["NetworkInterfaces"] = [{**interface, "DeviceIndex": "0"}]
    direct["NetworkInterfaces"] = [interface]
template = {"Resources": {"Instance": {
    "Type": "AWS::EC2::Instance", "Properties": properties,
}}}
direct_id, stack_id = None, None
try:
    direct_id = ec2.run_instances(**direct)["Instances"][0]["InstanceId"]
    stack_id = cfn.create_stack(StackName=name, TemplateBody=json.dumps(template))["StackId"]
    cfn.get_waiter("stack_create_complete").wait(StackName=stack_id, WaiterConfig=wait)
    cfn_id = cfn.describe_stack_resource(StackName=stack_id, LogicalResourceId="Instance")[
        "StackResourceDetail"]["PhysicalResourceId"]
    row = {"template": template, "subnet_is_public_by_default": True}
    for label, instance_id in (("direct", direct_id), ("cloudformation", cfn_id)):
        instance = ec2.describe_instances(InstanceIds=[instance_id])[
            "Reservations"][0]["Instances"][0]
        row[label] = {
            "state": instance["State"]["Name"],
            "subnet_matches": instance["SubnetId"] == subnet,
            "tags": {tag["Key"]: tag["Value"] for tag in instance.get("Tags", [])
                     if tag["Key"] in ("Name", "Reproduction")},
            "has_public_ipv4": bool(instance.get("PublicIpAddress")),
        }
    print(json.dumps({case: row}, indent=2), flush=True)
finally:
    if stack_id:
        cfn.delete_stack(StackName=stack_id)
        cfn.get_waiter("stack_delete_complete").wait(StackName=stack_id, WaiterConfig=wait)
    if direct_id:
        ec2.terminate_instances(InstanceIds=[direct_id])
        ec2.get_waiter("instance_terminated").wait(InstanceIds=[direct_id], WaiterConfig=wait)

PY

Expected

The explicit AssociatePublicIpAddress=false on the primary interface should suppress public-IP assignment even when the selected subnet has MapPublicIpOnLaunch=true, matching the direct EC2 control.

Observed

The direct instance has no public IPv4 address. The CloudFormation-owned instance has a public IPv4 address. Both instances are running. In this generic reproduction, the CloudFormation instance also uses a different subnet from the requested primary interface, as shown below. The CloudFormation template uses the schema-appropriate string DeviceIndex: "0"; the EC2 SDK request uses integer DeviceIndex: 0.

Focused result from the stock-image comparison:

{
  "direct": {
    "state": "running",
    "subnet_matches": true,
    "has_public_ipv4": false
  },
  "cloudformation": {
    "state": "running",
    "subnet_matches": false,
    "has_public_ipv4": true
  }
}

The reproduced instances and stacks were deleted through the ordinary EC2/CloudFormation APIs, and the disposable container was removed. To remove your reproduction container:

docker stop cfn-ec2-repro

Discussion #69 reports an Auto Scaling launch-template path. This report isolates the separate AWS::EC2::Instance CloudFormation path.

[AndreKurait]

Retested the unchanged minimal reproduction on the unmodified localstack/localstack-pro:dev image observed on 2026-10-22 (Linux amd64):

• Manifest: sha256:606d6fe73cbebe61c76d552864a73fa85d7fbd62a651c35a35fc76977b7d26c3
• Image config: sha256:87d720cefbcc168cac5b7e361d7a110bfef30cb2d18a8645a303225bf9ae9614

Direct EC2 RunInstances honored the requested subnet, both instance tags, and AssociatePublicIpAddress: false; all nine control checks passed.

The equivalent CloudFormation AWS::EC2::Instance still selected a different subnet, omitted the Name and custom instance tags, and assigned a public IP. The same AMI and instance type were retained, with the expected owner, instance identity, and running state. The requested subnet had MapPublicIpOnLaunch: true, so the explicit interface-level public-IP setting matters.

This used the normal licensed entrypoint with no added extensions, adapters, or init scripts. The stack and both instances were deleted after the comparison. Successful execution and cleanup do not mean the CloudFormation checks passed.