source_dest_check in aws_launch_configuration in terraform

Question

I am looking to make a newly launched ec2 instance with source_dest_check = disabled (by default it is enabled) from autoscaling launch configuration.

I know we can use source_dest_check = false for creating a ec2 resource , but how to achieve the same when managing the instances from ASG.

Terraform is not accepting below with (source_dest_check = false) , any other alternative to achieve this ?

can I achieve this from user data?

resource "aws_launch_configuration" "launchconfig" {
  name_prefix          = "bastion-"
  image_id             = "${data.aws_ami.amazon-linux-2.id}"
  instance_type        = "${var.instance_type}"
  placement_tenancy    = "default"
  enable_monitoring    = true
  #source_dest_check    = false
  security_groups      = ["${aws_security_group. security_group.id}"]
  iam_instance_profile = "${aws_iam_instance_profile.instance_profile.name}"
  key_name             = "${var. pem_key}"

  #Include user-data
  user_data = "${element(data.template_file.user_data.*.rendered, count.index)}"

  lifecycle {
    create_before_destroy = true
  }
}

Answer 1

According to Terraform documentation, source destination check (source_dest_check) is not supported for aws_launch_configuration resource type, it is only supported for aws_instance resource which is not really helpful in this case.

You can use user-data as a dirty workaround. First, you will need to fetch instance id from instance's metadata.

EC2_INSTANCE_ID="`wget -q -O - http://169.254.169.254/latest/meta-data/instance-id`"

then you can use ec2 cli to disable source-destination check for this particular instance.

aws ec2 modify-instance-attribute --no-source-dest-check --instance-id $EC2_INSTANCE_ID --region <REGION-WHERE-EC2-INSTANCE-IS-LAUNCHED>

Note that EC2 instance will need to have proper role attached to it so that it can make the call. Include this statement in the EC2 instance role's permissions.

{
    "Sid": "Allow Source-Dest check modification",
    "Effect": "Allow",
    "Action": "ec2:ModifyInstanceAttribute",
    "Resource": "*"
}