No Sensitive Info | Vulnerability Database

Ensure all data stored in the launch configuration EBS is securely encrypted

When creating Launch Configurations, user data can be used for the initial configuration of the instance. User data must not contain any sensitive data.

Impact

Sensitive credentials in user data can be leaked

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Don’t use sensitive data in user data

1
2
3
4
5
6
7
8
9


 resource "aws_launch_configuration" "as_conf" {
   name          = "web_config"
   image_id      = data.aws_ami.ubuntu.id
   instance_type = "t2.micro"
   user_data     = <<EOF
 export GREETING="Hello there"
 EOF
 }
 

1
2
3
4
5
6
7


 resource "aws_launch_configuration" "as_conf" {
 	name             = "web_config"
 	image_id         = data.aws_ami.ubuntu.id
 	instance_type    = "t2.micro"
 	user_data_base64 = "ZXhwb3J0IEVESVRPUj12aW1hY3M="
   }
   

Remediation Links

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration#user_data,user_data_base64