AWS CloudFormation: AutoScaling Group – You must use a valid fully-formed launch template

Steven WallAugust 2nd, 2020Last Updated: July 30th, 2020

1 2,010 1 minute read

I had a AWS CloudFormation template that included an Auto Scaling Group, Launch Template and Security Group.

The Auto Scaling Group being created was to use the Launch Template being created. And that Launch Template was to use the Security Group being created.

When I created my CloudFormation stack, the stack failed with this error when my Auto Scaling Group was been created:

CREATE_FAILED You must use a valid fully-formed launch template. The parameter groupName cannot be used with the parameter subnet (Service: AmazonAutoScaling; Status Code: 400; Error Code: ValidationError; Request ID: e3c2b7e1-d94b-4a8d-a044-c15ba8791b62)

Even though the error says the issue is with the Auto Scaling Group, my issue was with my Launch Template. I attempted to specify the associated Security Group using the SecurityGroups property.

However, I needed to use the SecurityGroupIds property since I was not using the default VPC. The SecurityGroups property documentation states:

Security Groups
[EC2-Classic, default VPC] One or more security group names. For a nondefault VPC, you must use security group IDs instead. You cannot specify both a security group ID and security name in the same request.
Source: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-launchtemplate-launchtemplatedata.html#cfn-ec2-launchtemplate-launchtemplatedata-securitygroups

When I switched to using SecurityGroupIds, my stack would create.

Here is the CloudFormation template for my Launch Template and Auto Scaling Group:

EC2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security Group for EC2 instances.
      #Other properties including SecurityGroupIngress, SecurityGroupEgress, VpcId
DemoLaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties: 
      LaunchTemplateName: demo-launch-template
      LaunchTemplateData: 
        BlockDeviceMappings: 
          - Ebs:
              VolumeSize: 8
              VolumeType: gp2
              DeleteOnTermination: true
              Encrypted: true
            DeviceName: /dev/xvdh
        ImageId: ami-098f16afa9edf40be
        InstanceType: t2.micro
        SecurityGroupIds:
          - !GetAtt EC2SecurityGroup.GroupId
DemoAutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      AutoScalingGroupName: demo-auto-scaling-group
      MinSize: "2"
      MaxSize: "4"
      DesiredCapacity: "2"
      HealthCheckGracePeriod: 300
      LaunchTemplate:
        LaunchTemplateId: !Ref DemoLaunchTemplate
        Version: !GetAtt DemoLaunchTemplate.LatestVersionNumber
      VPCZoneIdentifier:
        - subnet-0123
        - subnet-0456