EC2 instance user data contains no secrets

Check ID: ec2_instance_secrets_user_data
Provider: AWS
Service: ec2
Severity: HIGH
Categories: secrets
Resource type: AwsEc2Instance

What this check verifies

EC2 instance User Data is inspected for secret-like values (credentials, tokens, keys). Both plain and compressed content are parsed, honoring configured exclusions, to identify patterns that resemble sensitive material within initialization scripts.

Risk

Secrets embedded in User Data undermine confidentiality and integrity. Anyone with instance or build-system access can read them, reuse credentials to call services, exfiltrate data, or move laterally. Exposure may persist in AMIs, snapshots, and backups, increasing blast radius over time.

Recommendation

Avoid placing secrets in User Data. Store them in a managed secret service and fetch at runtime via a least-privilege instance role. Prefer short-lived credentials with regular rotation. Limit who can view or edit User Data and apply defense in depth with automated secret scanning in build pipelines.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 modify-instance-attribute --instance-id <INSTANCE_ID> --user-data "Value="

resource "aws_instance" "<example_resource_name>" {
  ami           = "<AMI_ID>"
  instance_type = "t3.micro"
  user_data     = "" # Critical: empty user data so no secrets are stored
}

# CloudFormation: EC2 instance with empty user data
Resources:
  <example_resource_name>:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: <AMI_ID>
      InstanceType: t3.micro
      UserData: !Base64 ""  # Critical: empty user data ensures no secrets are present

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_instance_secrets_user_data. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires