cis-aws-compute-2-13

name	cis-aws-compute-2.13
description	Ensure Secrets and Sensitive Data are not stored directly in EC2 User Data
category	cis-compute
version	1.1.0
author	cyberstrike-official
tags	["cis","aws","compute","ec2","user-data","secrets","sensitive-data","secrets-manager"]
cis_id	2.13
cis_benchmark	CIS AWS Compute Services Benchmark v1.1.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-compute-2.8"]
prerequisites	[]
severity_boost	{}

Ensure Secrets and Sensitive Data are not stored directly in EC2 User Data

Description

User Data can be specified when launching an ec2 instance. Examples include specifying parameters for configuring the instance or including a simple script.

Rationale

The user data is not protected by authentication or cryptographic methods. Therefore, sensitive data, such as passwords or long-lived encryption keys should not be stored as user data.

Impact

Anyone who has access to the instance and configuration can view the user data. Removing secrets from user data may require changes to instance bootstrapping processes.

Audit Procedure

Using AWS CLI

1. Run aws ec2 describe-instances to retrieve information about all instances in the AWS region. The output will include instance ids.

2. Run aws ec2 describe-instance-attribute for each instance in AWS account:

aws ec2 describe-instance-attribute --instance-id "ID of instance" --attribute userData

Note: User Data may be Base64 encoded. Decode the output as necessary.

3. Review user data to ensure no secrets or sensitive information are stored.
4. Repeat the Audit for all the other AWS regions.

Using AWS Console

1. Login to AWS Console using https://console.aws.amazon.com
2. Click All services and click EC2 under Compute.
3. Click on Instances.
4. For each instance, click Actions -> Instance Settings -> Edit user data.
5. For each instance, review the user data to ensure there are no secrets or sensitive data stored.
6. If secrets or sensitive data is found, refer to the remediation below.
7. Repeat steps 2-7 for all regions used.

Expected Result

No EC2 instance user data should contain secrets, passwords, API keys, or other sensitive information. User data should only contain non-sensitive configuration parameters or scripts that retrieve secrets from a secure source like AWS Secrets Manager.

Remediation

Using AWS CLI

No specific CLI remediation command is provided for this control. Use the console method below.

Using AWS Console

1. Login to AWS Console using https://console.aws.amazon.com