How do I set EC2 AutoRecovery behavior with AWS CDK?

To set the EC2 AutoRecovery behavior using AWS CDK for your BastionHostLinux instance, you can modify the instance's maintenance options. However, the suggestion from AWS Q is not entirely accurate for the BastionHostLinux construct.

Instead, you can use the instanceType property of the BastionHostLinux construct to specify a launch template, where you can define the maintenance options. Here's how you can modify your code to disable auto-recovery:

1. First, create a launch template:

const launchTemplate = new aws_ec2.LaunchTemplate(this, 'MyLaunchTemplate', {
  instanceType: aws_ec2.InstanceType.of(aws_ec2.InstanceClass.T3, aws_ec2.InstanceSize.MICRO),
  machineImage: new aws_ec2.AmazonLinuxImage(),
  instanceMaintenanceOptions: {
    autoRecovery: 'disabled'
  }
});

2. Then, use this launch template in your BastionHostLinux definition:

this.jumpServer = new aws_ec2.BastionHostLinux(this, `${id}-JumpServer`, {
  blockDevices: [
    {
      deviceName: "/dev/xvda",
      volume: aws_ec2.BlockDeviceVolume.ebs(8, {
        encrypted: true,
      }),
    },
  ],
  instanceName: `${id}-JumpServer`,
  subnetSelection: {
    subnetType: aws_ec2.SubnetType.PUBLIC,
  },
  vpc: props.vpc,
  instanceType: launchTemplate.instanceType,
  launchTemplate: launchTemplate
});

This approach uses a launch template to set the auto-recovery behavior to 'disabled'. The 'autoRecovery' property in the instanceMaintenanceOptions can be set to either 'disabled' or 'default'. Setting it to 'disabled' will prevent the instance from automatically restarting after deployments or system issues.

Remember that disabling auto-recovery means you'll need to manually recover the instance if it becomes impaired, which could impact the availability of your bastion host. Make sure this aligns with your operational requirements and disaster recovery plans.
Sources
interface MaintenanceOptionsProperty · AWS CDK
LaunchTemplateInstanceMaintenanceOptionsRequest - Amazon Elastic Compute Cloud

Hi, thank you for your answer! However, it did not work. I deployed again after adding the code, and the EC2 instance returned to auto-recovery enabled.