Amazon EC2 instances launched using Auto Scaling group launch configurations should not have Public IP addresses

How to fix it

Set at creation: fixing it means replacing the resource.

Have the launch configuration the finding names either not assigning a public IP address, with AssociatePublicIpAddress off, or deleted. A launch configuration cannot be modified, and AWS has closed creating new ones to newer accounts, so the setting moves onto a launch template with the Auto Scaling group repointed at it. That alone does not clear the finding: this check reads every launch configuration in the Region whether a group uses it or not, and the delete is refused while a group still refers to it.

In the console

EC2 → Auto Scaling → Launch configurations, and the Launch template or configuration setting on the Auto Scaling group