A production EC2 instance has termination protection enabled (its DisableApiTermination attribute is set to true) and is a member of an Auto Scaling group. Which of the following can still terminate this instance despite termination protection being enabled?
- A user calling the TerminateInstances API directly
- The Auto Scaling group replacing the instance during a scale-in event
- A user terminating the instance from the AWS Management Console's Instance State menu
- Termination protection has no exceptions; nothing can terminate the instance once it is enabled
Why B? And why not the others?
Correct answer: B. The Auto Scaling group replacing the instance during a scale-in event
The DisableApiTermination attribute blocks calls to the underlying TerminateInstances API, and because the console's terminate action and standard CLI or SDK terminate calls all route through that same API, both of those paths are blocked exactly as the attribute is designed to do. Amazon EC2 Auto Scaling, however, terminates and replaces instances during scale-in events and unhealthy-instance replacement through its own internal management logic, which is not restricted by this instance attribute, so a scale-in event can still remove a termination-protected instance from the group. The dedicated control for preventing that specific behavior is Auto Scaling's own instance scale-in protection feature, which must be enabled separately on a per-instance basis. That the console-based terminate action is blocked follows directly from it calling the same underlying API as a direct request. Claiming termination protection has no exceptions overstates what the attribute actually does; it guards specifically against direct API-driven termination, not every termination pathway on the platform.
Source: AWS EC2 documentation: Change instance termination protection — DisableApiTermination considerations