rage.fail

aws-ec2-userdata-secret

derived aws emits ExposesCredential

match (effective permission)

{ "action": "ec2:DescribeInstanceAttribute", "resource_type": "AWS::EC2::Instance" }

where

attribute == userData AND UserData contains a credential/secret

emit

source	`<EC2 instance>`
target	`<embedded credential/identity>`
permissions	`ec2:DescribeInstanceAttribute`

Narrative

{instance.name} UserData (readable via ec2:DescribeInstanceAttribute) contains embedded credentials.

Raw rule rules/derived/aws/ec2.yaml

id: aws-ec2-userdata-secret
emits: ExposesCredential
match_effective_permission:
  action: ec2:DescribeInstanceAttribute
  resource_type: AWS::EC2::Instance
where:
- attribute == userData AND UserData contains a credential/secret
emit:
  source: <EC2 instance>
  target: <embedded credential/identity>
  permissions:
  - ec2:DescribeInstanceAttribute
  false_positive_note: Only emit when UserData actually contains secret material; most UserData is benign
    bootstrap. Requires content inspection, not mere presence of the permission.
  narrative: '{instance.name} UserData (readable via ec2:DescribeInstanceAttribute) contains embedded
    credentials.'