As mentioned on Github, lxc.aa_profile isn’t a valid config key, it must go inside the raw.lxc section and since you’re using liblxc 3.0 or higher, it’s now called lxc.apparmor.profile.
The list of renamed keys was documented in the LXC 2.1 announcement and then linked to from the LXC 3.0 announcement: LXC 2.1 has been released
The full list of configuration keys supported in current liblxc (git) can be found at:
https://linuxcontainers.org/lxc/manpages//man5/lxc.container.conf.5.html