[Thaxll]

You should use 2 ASG ( blue / green ) and 1 ELB for that, then when you need to update the OS of one of the ASG you just update the launch configuration. It's easy to do in Terraform.

1) Update the launch configuration of your un-used ASG ( with the new AMI ID )

2) Apply terraform to deploy the new ASG

3) Make sure it's working ( your local app on your new instances )

4) Connect the ELB to your new ASG

5) Set the old ASG to 0 instances to drain the connections