Check ID: autoscaling_find_secrets_ec2_launch_configuration
Provider: AWS
Service: autoscaling
Severity: CRITICAL
Categories: secrets
Resource type: AwsAutoScalingLaunchConfiguration

​
What this check verifies

[DEPRECATED] EC2 Auto Scaling launch configurations are analyzed for secrets embedded in User Data, such as passwords, tokens, or API keys in bootstrapping scripts.

​
Risk

Secrets in User Data erode confidentiality and integrity:
  • Instance users or processes can read or log them
  • Exposed keys enable unauthorized API calls, data exfiltration, and lateral movement
  • Credential reuse increases blast radius across accounts and services

​
Recommendation

Never place secrets in User Data.
  • Use a managed secret store with an instance role to fetch at runtime
  • Enforce least privilege, rotate secrets, and avoid writing secrets to logs
  • Prefer short-lived, scoped credentials and layer controls for defense in depth

​
Remediation

# Launch configuration with no secrets in user data
resource "aws_launch_configuration" "<example_resource_name>" {
  image_id      = "<AMI_ID>"
  instance_type = "<INSTANCE_TYPE>"
  user_data     = "" # Critical: empty user data ensures no secrets are present
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = autoscaling_find_secrets_ec2_launch_configuration. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks