Prove user data is readable from inside the instance

short · 35 min · Objective 2.4

Task

The rule is that secrets never go in user data because it is readable from inside the instance. Demonstrate it, then implement the correct alternative, so the rule is something you have seen rather than something you were told.

Steps

  1. Launch an instance passing a bootstrap script containing the literal string NOT-A-REAL-CREDENTIAL-lab-only as an environment value.
  2. From inside the instance, as an UNPRIVILEGED user, retrieve the user data or instance metadata and find the string. Record the exact command and its output in lab/userdata.txt.
  3. Also check the places the lesson warns about: the process list, the environment of the running service, and any log the bootstrap wrote.
  4. Re-provision the instance with the credential removed from user data, fetching it instead from a local secret store at boot using an identity attached to the instance.
  5. Repeat step 2 and confirm the string is absent from user data. Record both results and write the one-line rule.

Verify

grep -c 'NOT-A-REAL-CREDENTIAL' lab/userdata.txt
grep -Eci 'unprivileged|non-root|normal user' lab/userdata.txt
grep -Eci 'absent|not present|no match' lab/userdata.txt

The file must record both finding it and, after the fix, not finding it. The unprivileged detail matters: the point is that any process on the instance can read it, not just root.

This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.