Deny access of read for i am user for instance attribute user data

Question

i have an requirement that i want to hide instance user data from any user, like I don't want to allow any iam user/role to read what my instance user data has,
I did tried to deny DescribeInstanceAttribute with condition for attribute "UserData"but that didn't worked.
i just want to know is it possible to hide this specific instance attribute "userData" from user?

Answer

It certainly seemed difficult to narrow it down with the condition key.
https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html#amazonec2-actions-as-permissions

It's not a radical solution, but why not store the contents of UserData in S3 and control browsing within S3?

I thought it would be good to unify the EC2 user data by getting, unpacking, and executing the UserData object in S3.

Deny access of read for i am user for instance attribute user data

Contenuto pertinente