AWS Security ChangesHomeSearch

AWS launchwizard medium security documentation change

Service: launchwizard · 2025-10-13 · Security-related medium

File: launchwizard/latest/userguide/launch-wizard-getting-started.md

Summary

Updated requirements to remove support for older Windows Server versions (2012, 2016) and SQL Server 2016/2017, while enforcing newer dependencies (e.g., Windows Server 2019+).

Security assessment

Removing support for outdated software (e.g., Windows Server 2012/2016, SQL Server 2016/2017) likely addresses security risks associated with end-of-life or unsupported versions. For example, dropping EC2Config (deprecated) and requiring newer OS versions reduces exposure to known vulnerabilities.

Diff

diff --git a/launchwizard/latest/userguide/launch-wizard-getting-started.md b/launchwizard/latest/userguide/launch-wizard-getting-started.md
index 3f48a96e0..1ce6bde9d 100644
--- a//launchwizard/latest/userguide/launch-wizard-getting-started.md
+++ b//launchwizard/latest/userguide/launch-wizard-getting-started.md
@@ -238 +238 @@ If you are [ deploying SQL Server into an existing VPC across multiple Availabil
-  * The domain functional level of your Active Directory domain controller must be Windows Server 2012 or later.
+  * The domain functional level of your Active Directory domain controller must be Windows Server 2019 or later.
@@ -291 +291 @@ Launch Wizard relies on user data to begin the process of configuring SQL Server
-If you use a custom Windows AMI, the volume drive letter for the root partition should be `C:` because EC2Launch v2 and EC2Config rely on this configuration to install the components. 
+If you use a custom Windows AMI, the volume drive letter for the root partition should be `C:` because EC2Launch v2 relies on this configuration to install the components. 
@@ -295,6 +295,4 @@ While not exhaustive, the following requirements cover most of the configuration
-Support matrix SQL Server Version | Windows Server 2016 | Windows Server 2019 | Windows Server 2022  
----|---|---|---  
-SQL Server 2016 |  YES |  YES | YES  
-SQL Server 2017 |  YES |  YES | YES  
-SQL Server 2019 | YES | YES | YES  
-SQL Server 2022 | YES | YES | YES  
+Support matrix SQL Server Version | Windows Server 2019 | Windows Server 2022  
+---|---|---  
+SQL Server 2019 | YES | YES  
+SQL Server 2022 | YES | YES  
@@ -304,2 +301,0 @@ SQL Server 2022 | YES | YES | YES
-  * Windows Server 2016 (Datacenter) (64-bit only)
-
@@ -314,2 +309,0 @@ SQL Server 2022 | YES | YES | YES
-  * SQL Server Enterprise Edition 2017/2016 or Standard Edition 2017/2016
-
@@ -331,4 +324,0 @@ SQL Server 2022 | YES | YES | YES
-  * EC2Config service (Windows Server 2012 R2)
-
-  * EC2Launch (Windows Server 2016)
-
@@ -414,11 +404,11 @@ Setting | Applies to
-Current EC2Launch v2 and SSM Agent |  Windows Server 2022, 2019, and 2016 *  
-Current EC2Launch and SSM Agent |  Windows Server 2019 and 2016 *  
-Current AWS PV, ENA, and NVMe drivers |  Windows Server 2022, 2019, and 2016  
-Current SRIOV drivers |  Windows Server 2022, 2019, and 2016  
-Microsoft SQL Server: Latest service pack SQL Service configured to start automatically SQL Service running `BUILTIN\Administrators` added to the `SysAdmin` server role TCP port `1433` and UDP port `1434` open |  Windows Server 2022, 2019, and 2016  
-Allow ICMP traffic through the firewall |  Windows Server 2022, 2019, and 2016  
-Allow RDP traffic through host firewall |  Windows Server 2022, 2019, and 2016  
-`RealTimeIsUniversal` registry key set |  Windows Server 2022, 2019, and 2016  
-SQL Server FCI |  Windows Server 2022, 2019, and 2016 SQL Server 2022, 2019, 2017, and 2016  
-  
-* Windows Server 2019 and 2016 can use either EC2Launch or EC2Launch v2 depending on what is configured in the AMI. For more information, see [Supported AMIs](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2launch-v2.html).
+Current EC2Launch v2 and SSM Agent |  Windows Server 2022 and 2019*  
+Current EC2Launch and SSM Agent |  Windows Server 2019*  
+Current AWS PV, ENA, and NVMe drivers |  Windows Server 2022 and 2019  
+Current SRIOV drivers |  Windows Server 2022 and 2019  
+Microsoft SQL Server: Latest service pack SQL Service configured to start automatically SQL Service running `BUILTIN\Administrators` added to the `SysAdmin` server role TCP port `1433` and UDP port `1434` open |  Windows Server 2022 and 2019  
+Allow ICMP traffic through the firewall |  Windows Server 2022 and 2019  
+Allow RDP traffic through host firewall |  Windows Server 2022 and 2019  
+`RealTimeIsUniversal` registry key set |  Windows Server 2022 and 2019  
+SQL Server FCI |  Windows Server 2022 and 2019 SQL Server 2022 and 2019  
+  
+* Windows Server 2019 can use either EC2Launch or EC2Launch v2 depending on what is configured in the AMI. For more information, see [Supported AMIs](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2launch-v2.html).
@@ -445,7 +434,0 @@ In most cases, Launch Wizard configures the correct protocols and ports. However
-**EC2Config** (Server 2012 R2)
-    
-
-**Installation**. We recommend using the latest version of EC2Config.
-
-**Service Start**. EC2Config service should be enabled.
-