Check ID: ec2_launch_template_no_secrets
Provider: AWS
Service: ec2
Severity: HIGH
Categories: secrets
Resource type: AwsEc2LaunchTemplate

​
What this check verifies

EC2 launch template user data is analyzed across versions to identify embedded secrets-hard-coded passwords, tokens, API keys, or private keys-within the startup scripts or configuration supplied to instances.

​
Risk

Secrets in user data can be read by identities able to view launch templates, eroding confidentiality. Exposed credentials enable unauthorized API actions, data exfiltration, and lateral movement. Past template versions retain leaked values, complicating rotation and recovery.

​
Recommendation

Keep user data free of secrets. Retrieve sensitive values at runtime from AWS Secrets Manager or SSM Parameter Store SecureString using instance roles. Enforce least privilege, rotate to short-lived credentials, and review template history; if exposure occurred, rotate affected secrets.

​
Remediation

# Terraform: Launch Template with empty user data
resource "aws_launch_template" "<example_resource_name>" {
  name      = "<example_resource_name>"
  user_data = ""  # Critical: empty user data prevents secrets from being stored
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_launch_template_no_secrets. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks