terraform-provider-aws: Error updating Autoscaling group: InvalidQueryParameter: Invalid launch template: When a network interface is provided, the security groups must be a part of it.

I encountered same problem and commenting out vpc_security_group_ids worked for me:

resource "aws_launch_template" "lt" {
  ...
  network_interfaces {
    ...
    security_groups = ["${aws_security_group.instance.id}"]
  }
  # vpc_security_group_ids = ["${aws_security_group.instance.id}"]
  ...
}
resource "aws_autoscaling_group" "asg" {
  ...
  launch_template {
    id = "${aws_launch_template.lt.id}"
    version = "$$Latest"
  }
  ...
}

@afalko Sorry, i think my comment was incomplete. Yes i deleted the environment and recreated but using terraform, no manual operations. But after doing it again today, i still get the error, so either specifying SGs or removing network_interfaces works. I can afford removing it that since i only wanted to disable public ip for the instance, which obviously is disabled by default for instances not within default VPC. Anyhow, I think i missed this from aws documentation:

The following are limitations when creating a launch template for use with an Auto Scaling group:
You cannot specify multiple network interfaces.
If you specify a network interface, its device index must be 0.
If you specify a network interface, you must specify any security groups as part of the network interface, and not in the Security Groups section of the template.
You cannot specify private IP addresses.
You cannot use host placement affinity.
If you specify Spot Instances, you must specify a one-time request with no end date.

The problem is, this is misleading since in terraform documentation, the example shows the usage of network_interfaces this way:

network_interfaces {
    associate_public_ip_address = true
  }

But this does not work (at least did not work for me) and terraform complains about security groups that need to be added, even though no network interface was mentioned in that block. I hope someone takes a look at this and provides some insight for us.

Update: Ok this is how i solved this for me. I kept the vpc_security_group_ids in place and removed security_groups from network_interfaces. Then updated the ASG configuration:

launch_template = {
    id         = "${aws_launch_template.nodes.id}"
    version = "${aws_launch_template.nodes.latest_version}"
  }

The issue for me was that this was using the default version of the Launch Template instead of the latest one (as version increases automatically in aws even if you don’t specify it).

That’s not a bug/issue, but intended behavior by AWS: https://docs.aws.amazon.com/autoscaling/ec2/userguide/create-launch-template.html

If you specify a network interface, you must configure the security group as part of the network interface, and not in the Security Groups section of the template.

And confirmed by AWS (from my support ticket):

you have to explicitly set SG on the interface level that because an instance could have multiple interfaces each associated with separate security groups, otherwise if you don’t specify network interfaces the instance will just get its default interface and the SGs defined in the top-level “security groups” section will just be attached as the default behavior

So in case setting network interface you just need to provide SG on the interface level and remove vpc_security_group_ids from the resource

I reproduced this without terraform so I think this is an AWS issue, but this is interesting:

1. Create a launch template and specify security groups in both the network interface and also the “security groups” section at the bottom of the template
2. Create an ASG from this launch template
3. Boom, error.

Now, go back and edit the launch template.

1. Remove the SG from the bottom, not the interface.
2. Save the LT and go back and create a new ASG from the new revision.
3. Works, ASG created.

So I removed vpc_security_group_ids and now I get https://github.com/terraform-providers/terraform-provider-aws/issues/4553

I was also able to get around this by removing vpc_security_group_ids from the aws_launch_template and adding them instead in the network_interfaces block. I also had to include the subnet in the vpc_zone_identifier list in the aws_autoscaling_group and I used the ${aws_launch_template.nodes.latest_version} format.

To provide what seems to be a working example of the necessary parts:

resource "aws_launch_template" "example" {
  ...
  # Do not include vpc_security_group_ids
  network_interfaces {
    associate_public_ip_address = true
    security_groups             = ["${aws_security_group.example.id}"]
    subnet_id                   = "${aws_subnet.example.id}"
  }
}

resource "aws_autoscaling_group" "example" {
  ...
  vpc_zone_identifier = ["${aws_subnet.example.id}"]

  launch_template = {
    id      = "${aws_launch_template.example.id}"
    version = "${aws_launch_template.example.latest_version}"
  }
}

I think this comes from a limitation in the EC2 API where instance security groups aren’t compatible with network interfaces with public IP addresses (only the network interface will have a security group), but the vague error message makes me unsure.

I tried doing what @Yashiroo did, but I still get there error. Did you clear terraform and manually delete the resources?

This worked for me, but only after I attempted Yashiroo’s workaround:

...
  #vpc_security_group_ids = ["${aws_security_group.jenkins-nodes.id}"]
  network_interfaces {
    associate_public_ip_address = true
    security_groups = ["${aws_security_group.jenkins-nodes.id}"]
  }
...