bug: Auto Scaling places every instance in the first subnet despite multiple availability zones

[AndreKurait]

Current behavior

On a freshly pulled localstack/localstack-pro:dev, Auto Scaling advertises both configured availability zones but launches every instance into the first subnet in VPCZoneIdentifier. This occurs with a launch configuration, a launch template, and a template containing a new device-zero network interface. Creating at desired capacity 2 and then increasing to 3 and 4 always gives zone counts 2/0, 3/0, 4/0.

Direct RunInstances in either subnet reports the correct zone. Instance Placement.AvailabilityZone is consistent with its subnet; the defect is ASG distribution, not the EC2 response field.

Expected behavior

For an ordinary on-demand ASG with two available zones and no simulated capacity constraints, new instances should be distributed across the configured zones, giving counts 1/1, 2/1 (either orientation), and 2/2. AWS describes the availability-zone distribution behavior here: https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-availability-zone-balanced.html

Exact tested environment

• Linux x86_64, isolated stock vendor container, EC2_VM_MANAGER=mock.
• No harness adapters, provider patches, Docker socket mount or real AWS resources.
• Image: localstack/localstack-pro@sha256:a9b3e374db5310d706c6676a498f22b2b33a45a110ec79dbd7c41f07209c7e28
• Local image ID: sha256:9581779d9198ddfa6f1a300760edaf7f28052eb2cfdd8f713bb528b186e0cbcc
• localstack-core 2026.10.0.dev101, moto-ext 5.1.51, boto3/botocore 1.43.108.
• Reproduced on 2026-10-10; all nine ASG cases failed the balance check, both direct EC2 controls passed. API cleanup had no errors; disposable container/volume/network cleanup passed.

The bundled public Moto FakeAutoScalingGroup.replace_autoscaling_group_instances selects the first subnet and submits one run_instances call for the entire requested count. I have not yet run this reproducer against standalone upstream Moto, so this report is specifically about the tested LocalStack bundle.

Reproducer

Save the Python below as reproduce.py. Use an existing private license.env for your LocalStack license; it is not included in the report. The example does not publish a host port:

docker run -d --name ls-asg-zones --env-file ./license.env \
  -e EC2_VM_MANAGER=mock -e SERVICES=ec2,autoscaling,iam,sts \
  localstack/localstack-pro@sha256:a9b3e374db5310d706c6676a498f22b2b33a45a110ec79dbd7c41f07209c7e28
# After LocalStack reports Ready:
docker exec -i ls-asg-zones /opt/code/localstack/.venv/bin/python - < reproduce.py
# Remove only this reproducer's container and anonymous volume afterward:
docker rm -f -v ls-asg-zones

"""Public API reproduction with synthetic account/VPC inputs only."""
from collections import Counter
import json
import uuid

import boto3
from botocore.config import Config

options = dict(
    endpoint_url="http://127.0.0.1:4566", region_name="eu-west-1",
    aws_access_key_id="111111111111", aws_secret_access_key="test",
    config=Config(proxies={}, connect_timeout=3, read_timeout=15,
                  retries={"total_max_attempts": 1}),
)
ec2, asg = (boto3.client(name, **options) for name in ("ec2", "autoscaling"))
nonce = "zone-proof-" + uuid.uuid4().hex[:10]
report = {"cases": [], "cleanup_errors": []}
image = ec2.register_image(Name=nonce, Architecture="x86_64", RootDeviceName="/dev/sda1")["ImageId"]
vpc = ec2.create_vpc(CidrBlock="10.86.0.0/16")["Vpc"]["VpcId"]
subnets = [
    ec2.create_subnet(VpcId=vpc, CidrBlock=f"10.86.{index}.0/24", AvailabilityZone=zone)["Subnet"]
    for index, zone in enumerate(("eu-west-1a", "eu-west-1b"), 1)
]
zone_for = {subnet["SubnetId"]: subnet["AvailabilityZone"] for subnet in subnets}


def details(ids):
    return [item for reservation in ec2.describe_instances(InstanceIds=ids)["Reservations"]
            for item in reservation["Instances"]]


for subnet in subnets:
    response = ec2.run_instances(
        ImageId=image, InstanceType="t3.micro", MinCount=1, MaxCount=1, SubnetId=subnet["SubnetId"])
    item = details([response["Instances"][0]["InstanceId"]])[0]
    actual = item["Placement"]["AvailabilityZone"]
    report["cases"].append({
        "case": "direct-subnet-zone", "subnet_zone": subnet["AvailabilityZone"],
        "actual_zone": actual, "pass": actual == subnet["AvailabilityZone"],
    })
    ec2.terminate_instances(InstanceIds=[item["InstanceId"]])

for kind in ("template", "template-interface", "configuration"):
    name = nonce + "-" + kind
    data = {"ImageId": image, "InstanceType": "t3.micro"}
    if kind == "template-interface":
        data["NetworkInterfaces"] = [{"DeviceIndex": 0, "AssociatePublicIpAddress": False}]
    if kind.startswith("template"):
        template = ec2.create_launch_template(LaunchTemplateName=name, LaunchTemplateData=data)
        selected = {"LaunchTemplate": {
            "LaunchTemplateId": template["LaunchTemplate"]["LaunchTemplateId"], "Version": "1"}}
    else:
        asg.create_launch_configuration(LaunchConfigurationName=name, **data)
        selected = {"LaunchConfigurationName": name}
    asg.create_auto_scaling_group(
        AutoScalingGroupName=name, MinSize=2, MaxSize=4, DesiredCapacity=2,
        VPCZoneIdentifier=",".join(zone_for), **selected)
    for desired in (2, 3, 4):
        if desired != 2:
            asg.set_desired_capacity(AutoScalingGroupName=name, DesiredCapacity=desired)
        group = asg.describe_auto_scaling_groups(AutoScalingGroupNames=[name])["AutoScalingGroups"][0]
        instances = details([item["InstanceId"] for item in group["Instances"]])
        counts = Counter(zone_for[item["SubnetId"]] for item in instances)
        balanced = abs(counts["eu-west-1a"] - counts["eu-west-1b"]) <= 1
        placement_matches = all(item["Placement"]["AvailabilityZone"] == zone_for[item["SubnetId"]]
                                for item in instances)
        report["cases"].append({
            "case": kind, "desired": desired, "actual_count": len(instances),
            "subnet_zone_counts": dict(counts), "placement_matches_subnet": placement_matches,
            "group_zones": group["AvailabilityZones"],
            "pass": len(instances) == desired and balanced and placement_matches,
        })
    asg.delete_auto_scaling_group(AutoScalingGroupName=name, ForceDelete=True)
    if selected.get("LaunchTemplate"):
        ec2.delete_launch_template(LaunchTemplateId=selected["LaunchTemplate"]["LaunchTemplateId"])
    else:
        asg.delete_launch_configuration(LaunchConfigurationName=name)
for subnet in subnets:
    try:
        ec2.delete_subnet(SubnetId=subnet["SubnetId"])
    except Exception as error:
        report["cleanup_errors"].append({"operation": "delete_subnet", "error": str(error)})
try:
    ec2.delete_vpc(VpcId=vpc)
    ec2.deregister_image(ImageId=image)
except Exception as error:
    report["cleanup_errors"].append({"operation": "delete_vpc/deregister_image", "error": str(error)})
report["status"] = "PASS" if all(case["pass"] for case in report["cases"]) else "FAIL"
print(json.dumps(report, indent=2))

The script prints each actual subnet/zone count and retains native failures. An execution failure should not be interpreted as a successful reproduction; the tested run completed all cases.

AI-assisted report; the stated results were obtained from the actual stock container and public SDK calls.

[drauedo]

Thanks for the report!

I was able to recreate the issue and i'll proceed to inform Engineering so they can fix this issue. I'll keep you posted if any updates arises.