| name | cis-aws-compute-2.13 |
| description | Ensure Secrets and Sensitive Data are not stored directly in EC2 User Data |
| category | cis-compute |
| version | 1.1.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","compute","ec2","user-data","secrets","sensitive-data","secrets-manager"] |
| cis_id | 2.13 |
| cis_benchmark | CIS AWS Compute Services Benchmark v1.1.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-compute-2.8"] |
| prerequisites | [] |
| severity_boost | {} |
Ensure Secrets and Sensitive Data are not stored directly in EC2 User Data
Description
User Data can be specified when launching an ec2 instance. Examples include specifying parameters for configuring the instance or including a simple script.
Rationale
The user data is not protected by authentication or cryptographic methods. Therefore, sensitive data, such as passwords or long-lived encryption keys should not be stored as user data.
Impact
Anyone who has access to the instance and configuration can view the user data. Removing secrets from user data may require changes to instance bootstrapping processes.
Audit Procedure
Using AWS CLI
-
Run aws ec2 describe-instances to retrieve information about all instances in the AWS region. The output will include instance ids.
-
Run aws ec2 describe-instance-attribute for each instance in AWS account:
aws ec2 describe-instance-attribute --instance-id "ID of instance" --attribute userData
Note: User Data may be Base64 encoded. Decode the output as necessary.
- Review user data to ensure no secrets or sensitive information are stored.
- Repeat the Audit for all the other AWS regions.
Using AWS Console
- Login to AWS Console using https://console.aws.amazon.com
- Click
All services and click EC2 under Compute.
- Click on
Instances.
- For each instance, click
Actions -> Instance Settings -> Edit user data.
- For each instance, review the user data to ensure there are no secrets or sensitive data stored.
- If secrets or sensitive data is found, refer to the remediation below.
- Repeat steps 2-7 for all regions used.
Expected Result
No EC2 instance user data should contain secrets, passwords, API keys, or other sensitive information. User data should only contain non-sensitive configuration parameters or scripts that retrieve secrets from a secure source like AWS Secrets Manager.
Remediation
Using AWS CLI
No specific CLI remediation command is provided for this control. Use the console method below.
Using AWS Console
- Login to AWS Console using https://console.aws.amazon.com
