When working with AWS CloudFormation templates for EC2 instances, there are scenarios where we need the flexibility to either:

• Assign a specific static private IP address when required
• Let AWS automatically assign a dynamic private IP when no specific IP is needed

The core issue arises when trying to implement this conditional logic in the CloudFormation template. The intuitive approach using Fn::If fails because CloudFormation doesn't accept empty strings or null values for the PrivateIpAddress property.

Here's how to properly implement this conditional assignment:

{
  "Resources": {
    "MyEC2Instance": {
      "Type": "AWS::EC2::Instance",
      "Properties": {
        "InstanceType": "t3.micro",
        "ImageId": "ami-12345678",
        "NetworkInterfaces": [
          {
            "AssociatePublicIpAddress": false,
            "DeviceIndex": "0",
            "SubnetId": {"Ref": "Subnet"},
            "GroupSet": [{"Ref": "SecurityGroup"}],
            "PrivateIpAddresses": [
              {
                "PrivateIpAddress": {"Ref": "PrivateIP"},
                "Primary": true
              }
            ]
          }
        ]
      },
      "Condition": "RequestedPrivateIP"
    },
    "MyEC2InstanceNoIP": {
      "Type": "AWS::EC2::Instance",
      "Properties": {
        "InstanceType": "t3.micro",
        "ImageId": "ami-12345678",
        "SubnetId": {"Ref": "Subnet"},
        "SecurityGroupIds": [{"Ref": "SecurityGroup"}]
      },
      "Condition": "NoPrivateIPRequested"
    }
  },
  "Conditions": {
    "RequestedPrivateIP": {"Fn::Not": [{"Fn::Equals": [{"Ref": "PrivateIP"}, ""]}]},
    "NoPrivateIPRequested": {"Fn::Equals": [{"Ref": "PrivateIP"}, ""]}
  }
}

For those preferring YAML format:

Resources:
  MyEC2Instance:
    Type: AWS::EC2::Instance
    Condition: RequestedPrivateIP
    Properties:
      InstanceType: t3.micro
      ImageId: ami-12345678
      NetworkInterfaces:
        - AssociatePublicIpAddress: false
          DeviceIndex: '0'
          SubnetId: !Ref Subnet
          GroupSet:
            - !Ref SecurityGroup
          PrivateIpAddresses:
            - PrivateIpAddress: !Ref PrivateIP
              Primary: true

  MyEC2InstanceNoIP:
    Type: AWS::EC2::Instance
    Condition: NoPrivateIPRequested
    Properties:
      InstanceType: t3.micro
      ImageId: ami-12345678
      SubnetId: !Ref Subnet
      SecurityGroupIds:
        - !Ref SecurityGroup

Conditions:
  RequestedPrivateIP: !Not [!Equals [!Ref PrivateIP, '']]
  NoPrivateIPRequested: !Equals [!Ref PrivateIP, '']

• Use separate resource definitions with Conditions rather than trying to make the PrivateIpAddress property conditional
• The NetworkInterfaces property approach is required when specifying PrivateIpAddress
• The standard EC2 properties (without NetworkInterfaces) work fine when letting AWS assign the IP
• Make sure your Conditions properly evaluate the input parameter

Here's how to define the PrivateIP parameter in your template:

"Parameters": {
  "PrivateIP": {
    "Type": "String",
    "Description": "Optional private IP address for the instance",
    "Default": "",
    "AllowedPattern": "(^$|^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$)",
    "ConstraintDescription": "Must be a valid IPv4 address or empty"
  }
}

When working with AWS CloudFormation templates for EC2 instances, developers often need to handle scenarios where some instances require static private IP addresses while others should use DHCP-assigned addresses. The problem occurs when trying to make the PrivateIpAddress property conditional.

The intuitive solution using Fn::If doesn't work because CloudFormation expects either:

• A valid IP address string when the condition is true
• Complete omission of the property when false

An empty string as the 'false' case fails validation.

The correct approach uses the AWS::NoValue pseudo-parameter in the false case:

"Resources": {
  "MyEC2Instance": {
    "Type": "AWS::EC2::Instance",
    "Properties": {
      "PrivateIpAddress": {
        "Fn::If": [
          "RequestedPrivateIP",
          {"Ref": "PrivateIP"},
          {"Ref": "AWS::NoValue"}
        ]
      },
      // Other required properties...
    }
  }
}

Here's a full working template demonstrating the pattern:

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Parameters": {
    "PrivateIP": {
      "Type": "String",
      "Default": "",
      "Description": "Optional private IP address"
    }
  },
  "Conditions": {
    "RequestedPrivateIP": {"Fn::Not": [{"Fn::Equals": [{"Ref": "PrivateIP"}, ""]}]}
  },
  "Resources": {
    "WebServer": {
      "Type": "AWS::EC2::Instance",
      "Properties": {
        "ImageId": "ami-12345678",
        "InstanceType": "t3.micro",
        "SubnetId": "subnet-123456",
        "PrivateIpAddress": {
          "Fn::If": [
            "RequestedPrivateIP",
            {"Ref": "PrivateIP"},
            {"Ref": "AWS::NoValue"}
          ]
        },
        "SecurityGroupIds": ["sg-12345678"]
      }
    }
  }
}

For YAML templates, the syntax is cleaner:

Resources:
  WebServer:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: ami-12345678
      InstanceType: t3.micro
      PrivateIpAddress: !If 
        - RequestedPrivateIP
        - !Ref PrivateIP
        - !Ref "AWS::NoValue"

• Ensure the requested IP is within the subnet's CIDR range
• The IP must not already be in use
• Consider using AWS Systems Manager Parameter Store for IP management
• For production deployments, implement IPAM solutions

Always validate your template with:

aws cloudformation validate-template --template-body file://template.json

Test both conditional branches by deploying with and without the PrivateIP parameter.