EC2 launch templates should not assign public IPs to network interfaces

How to fix it

Leave every network interface in the launch template with public IP association turned off, so instances launched from it get no public IPv4 address.

In the console

EC2 → Launch Templates → the template → Actions → Modify template (Create new version) → Network interfaces

With Terraform

resource "aws_launch_template" "this" {
  network_interfaces {
    associate_public_ip_address = "false"
  }
}