AWS EC2 Bulk User Data Enumeration

The Elastic detection rule monitors AWS CloudTrail logs for the 'DescribeInstanceAttribute' API action when the 'userData' attribute is requested. Bulk enumeration of this attribute is a high-risk activity, as instance user data often contains sensitive bootstrap scripts, hardcoded credentials, or API tokens. The rule triggers when a single principal, identified by ARN and source IP, accesses this attribute for more than 20 distinct EC2 instances in a 10-minute lookback period.

Impact

Unauthorized access to EC2 user data can lead to the exposure of plain-text secrets, environment-specific configuration tokens, and infrastructure-level credentials, facilitating further privilege escalation or lateral movement within the cloud environment.

Recommendation

• Deploy the provided Elastic detection logic to monitor CloudTrail for bulk 'DescribeInstanceAttribute' calls.
• Review alerts triggered by this rule for unauthorized principals, particularly those originating from unexpected ASNs or non-standard user agents.
• Investigate the retrieved 'instanceId' values to determine if sensitive production workloads are targeted.
• Implement a policy of least privilege, restricting 'ec2:DescribeInstanceAttribute' access to only those roles that require it for operational health or inventory management.
• Audit existing instance user data and migrate sensitive secrets to dedicated solutions such as AWS Secrets Manager or Systems Manager Parameter Store.