feat(autoscaling): add an option to run validation when migrating to launch template

packages/aws-cdk-lib/aws-autoscaling/lib/auto-scaling-group.ts

@@ -667,6 +667,13 @@ export interface AutoScalingGroupProps extends CommonAutoScalingGroupProps {
    */
   readonly launchTemplate?: ec2.ILaunchTemplate;
 
+  /**
+   * Whether safety guardrail should be enforced when migrating to the launch template.
+   *
+   * @default false
+   */
+  readonly migrateToLaunchTemplate?: boolean;
+
   /**
    * Mixed Instances Policy to use.
    *
@@ -1368,6 +1375,7 @@ export class AutoScalingGroup extends AutoScalingGroupBase implements
     let launchTemplateFromConfig: ec2.LaunchTemplate | undefined = undefined;
     if (props.launchTemplate || props.mixedInstancesPolicy) {
       this.verifyNoLaunchConfigPropIsGiven(props);
+      this.verifyUpdatePolicyIsGiven(props);
 
       const bareLaunchTemplate = props.launchTemplate;
       const mixedInstancesPolicy = props.mixedInstancesPolicy;
@@ -1816,6 +1824,17 @@ export class AutoScalingGroup extends AutoScalingGroupBase implements
     }
   }
 
+  private verifyUpdatePolicyIsGiven(props: AutoScalingGroupProps) {
+    if (props.migrateToLaunchTemplate === true && !props.updatePolicy) {
+      throw new ValidationError(
+        'When migrateToLaunchTemplate is true, you must also provide an updatePolicy ' +
+        'to ensure instances are properly replaced during migration. ' +
+        'This prevents instances from referencing a deleted IAM instance profile. ' +
+        'Use UpdatePolicy.rollingUpdate() to define your rolling update settings.',
+        this);
+    }
+  }
+
   /**
    * Apply CloudFormation update policies for the AutoScalingGroup
    */

packages/aws-cdk-lib/aws-autoscaling/test/auto-scaling-group.test.ts

@@ -3086,6 +3086,26 @@ describe('InstanceMaintenancePolicy', () => {
   });
 });
 
+test('throws if updatePolicy is not set when migrateToLaunchTemplate is true', () => {
+  // GIVEN
+  const stack = new cdk.Stack();
+  stack.node.setContext(AUTOSCALING_GENERATE_LAUNCH_TEMPLATE, true);
+  const vpc = mockVpc(stack);
+  const lt = LaunchTemplate.fromLaunchTemplateAttributes(stack, 'imported-lt', {
+    launchTemplateId: 'test-lt-id',
+    versionNumber: '0',
+  });
+
+  // THEN
+  expect(() => {
+    new autoscaling.AutoScalingGroup(stack, 'MyFleet', {
+      vpc,
+      launchTemplate: lt,
+      migrateToLaunchTemplate: true,
+    });
+  }).toThrow(/When migrateToLaunchTemplate is true, you must also provide an updatePolicy to ensure instances are properly replaced during migration. This prevents instances from referencing a deleted IAM instance profile. Use UpdatePolicy.rollingUpdate\(\) to define your rolling update settings./);
+});
+
 function mockSecurityGroup(stack: cdk.Stack) {
   return ec2.SecurityGroup.fromSecurityGroupId(stack, 'MySG', 'most-secure');
 }