Running Ubuntu Pro with AWS Auto Scaling Groups

Project Discussion Ubuntu on AWS
1

When deploying Ubuntu workloads within an AWS Auto Scaling Group (ASG), maintaining a strong security posture requires timely patches (such as ESM Infrastructure and ESM Apps).

Because ASG instances are ephemeral and can be replaced at any time, standard manual patching is insufficient.

To ensure new instances launch with Ubuntu Pro enabled and fully patched, you can implement either a Metered-License (Native AMI) approach or a Token-Attached approach.

Method 1: AWS Marketplace / Native Ubuntu Pro AMIs (Recommended)

This is the most native and robust solution. It uses an official Ubuntu Pro Amazon Machine Image (AMI) billed directly through your AWS account, removing the need to manage individual subscription tokens.

Step 1: Find the Correct Ubuntu Pro AMI ID

To update your ASG’s Launch Template, you must first locate the correct Ubuntu Pro AMI for your desired Ubuntu version (e.g., Focal 20.04, Jammy 22.04, Noble 24.04).
You can find this using one of three options:

  • Option A: AWS Marketplace Search via Launch Template
    When modifying your Launch Template, scroll to the AMIs section, click Browse more AMIs, select AWS Marketplace AMIs, and search for “Ubuntu Pro”:

    111
    1111200×662 100 KB

  • Option B: AWS EC2 Catalog Search
    Navigate to EC2 > AMIs, switch the dropdown to Public images, and search using the specific naming pattern (which could be found in our documentation page):

    222
    2221100×793 107 KB

    For example:
    AMI name=ubuntu-pro-server/images/hvm-ssd/ubuntu-focal-20.04-amd64-pro-server-*
    AMI name=ubuntu-pro-server/images/hvm-ssd/ubuntu-jammy-22.04-amd64-pro-server-*
    AMI name=ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-*

    333
    3331200×409 82.6 KB

  • Option C: AWS Systems Manager (SSM) Parameter Store
    Open AWS CloudShell and query Canonical’s public parameter path to grab the latest stable AMI ID (which could be found in our documentation page):

    $ aws ssm get-parameters --names /aws/service/canonical/ubuntu/pro-server/focal/stable/current/amd64/hvm/ebs-gp2/ami-id

$ aws ssm get-parameters --names /aws/service/canonical/ubuntu/pro-server/jammy/stable/current/amd64/hvm/ebs-gp2/ami-id

$ aws ssm get-parameters --names /aws/service/canonical/ubuntu/server/noble/stable/current/amd64/hvm/ebs-gp3/ami-id

    444
    4441200×332 46.3 KB

Step 2: Update the Launch Template

  1. In your Auto Scaling Group’s Launch Template > Actions > Modify the Launch Template (Create new version) input the retrieved Ubuntu Pro AMI ID into the AMI field.

  2. AWS UI WARNING: After switching to a Marketplace AMI, the AWS console UI may automatically change the Security Group field to “Create new security group”.
    Check the group and switch it back to “Select existing security group” if needed.

  3. In the Advanced Details section, navigate to the User Data field and input the automated update script to ensure instances patch themselves immediately on boot:

    #!/bin/bash	
# Apply pending infrastructure and application security patches	
apt update && apt upgrade -y

  4. Click Create new template version.

Method 2: Attaching an Ubuntu Pro Token via User Data

If you prefer to bring your own Ubuntu Pro subscription token (from a corporate contract or the free personal tier), you can use standard Ubuntu AMIs and attach the token dynamically at boot time.

Step 1: Retrieve Your Token

Log in to your Ubuntu account dashboard at ubuntu.com/pro and copy your unique alphanumeric machine token.

Step 2: Inject the Token via Launch Template User Data

  1. Modify your ASG’s Launch Template to create a new version.

  2. Keep your standard Ubuntu AMI, but navigate to Advanced Details > User data.

  3. Add the following initialization script to attach the subscription and run security upgrades natively during cloud-init:

    #!/bin/bash	
# Attach the Ubuntu Pro subscription token	
pro attach <YOUR_PRO_TOKEN>	
# Apply pending infrastructure and application security patches	
apt update && apt upgrade -y

Method 3: The Golden Image Strategy (Best Practice for Scaling)

While Methods 1 and 2 apply updates at boot time, they increase the launch duration (cloud-init time) for new instances.
For high-availability production environments, the most complete solution is to create a customized AMI:

  1. Launch a single standalone EC2 instance using your desired Ubuntu version.

  2. Attach your Ubuntu Pro subscription or use a Pro marketplace image.

  3. Run all updates and apply changes or install packages required for your organization.
    Stop the instance and create a Custom AMI from it.
    Select the EC2 instance - then Actions - Image and templates - Create image.

  4. Point your ASG Launch Template to this pre-baked, hardened, and patched AMI.

Activating Changes Natively in the ASG

Modifying a Launch Template does not retroactively update live servers.
To cycle your fleet onto the newly configured Ubuntu Pro setup:

  1. Go to your Auto Scaling Group, click Edit, and change the Launch Template Version to Latest (the fresh version that was created).

  2. Recycle your instances using one of two methods:

  • Instance Refresh (Graceful): Click Instance refresh > Start instance refresh to swap instances sequentially without downtime.

  • Manual Termination: Terminate old instances directly; the ASG will spin up replacements based on the new configurations.

  1. Once the new instances complete their initialization, log in via Session Manager and verify your subscription status:

    $ pro status