How to _remove_ security groups from launch template version

Question

I'm trying to use the CLI to remove security groups (SGs) from a launch template (LT).
When updating the LT version, my config JSON looks like so:
```
{
    "SecurityGroupIds": []
}
```
... but this isn't removing the SGs from the newly-created LT version. I believe the `create-launch-template-version` operation is taking the _union_ of the existing SGs and the newly-specified SGs, but I want to _replace_ the existing SGs (in this case with zero SGs).

How can I delete SGs for a new LT version? (Using the Console isn't feasible for me, I have thousands of LTs.)

Answer

To remove all security groups from a launch template version when creating a new version, you need to use the SecurityGroupIds parameter along with the DefaultSecurityGroupIds parameter in the create-launch-template-version command. Here's the command you can use:

```
aws ec2 create-launch-template-version \
    --launch-template-id  \
    --version-description "Remove security groups" \
    --source-version  \
    --launch-template-data '{"SecurityGroupIds": [], "DefaultSecurityGroupIds": []}' \
    --region 
```
Replace the following:
*  with the ID of your launch template
*  with the version number you want to base the new version on
*  with the AWS region where your launch template resides

However, when you create a new EC2 instance using a launch template without any security groups specified, AWS will automatically assign the [default security group](https://docs.aws.amazon.com/vpc/latest/userguide/default-security-group.html) to the instance.

If your goal is to not allow any inbound/outbound traffic to the instance, I would suggest attaching a security group with no inbound/outbound rules. Alternatively, you could edit the default security group to remove the inbound/outbound rules, but I would not recommend doing this. If you go either of these routes, you will not be able to connect to your instances, and your instances won't be able to connect to anything.

**To make sure we're implementing the best solution, may I ask why you want to launch instances without a security group attached?**

How to _remove_ security groups from launch template version

Relevant content