Skip to content
koducathome

AWS EC2 User Data Script Generator

Build EC2 startup scripts for Linux and Windows, with pinned package versions.

How to use this tool

Steps for using the EC2 User Data Generator.

  1. Under Basic Configuration, search for and pick the operating system of your AMI, then choose Bash or Cloud-Init (Linux) — Windows Server uses PowerShell.
  2. Under Setup Tasks, switch on what the instance should do: install packages, update the system, create a user, set environment variables, set up Docker, a web server, AWS CLI v2, a storage volume, the CloudWatch agent or custom commands.
  3. Click a task to change its settings under Configure Options. For packages, search the catalog or start from a preset, then pick Latest compatible, a Specific catalog version or a Custom version for each package.
  4. Read the Checks under the script: errors must be fixed before you can copy or download; warnings explain risks such as unverified version pins or secrets in user data.
  5. Copy or Download the script, or Share a link to the configuration (secret values are left out). Paste the script into Advanced details → User data when you launch the instance.

Example

Nginx with a pinned version on Ubuntu 24.04 (Bash)

Settings
OS: Ubuntu 24.04 LTS · Format: Bash
Packages: git (latest), nginx (custom version 1.24.0-2ubuntu7)
Install step
# Pinned versions fail if unavailable — there is no fallback to latest.
apt-get -o DPkg::Lock::Timeout=300 install -y --no-install-recommends git nginx=1.24.0-2ubuntu7

Common use cases

  • Bootstrapping web servers with Nginx or Apache on first boot
  • Preparing Docker hosts with Docker Engine and Compose
  • Creating a deploy user with an SSH key and sudo
  • Installing a specific Java, Python or Node.js version
  • Mounting an attached EBS volume safely
  • Installing the CloudWatch agent with a basic configuration

How EC2 user data works

User data is a script or configuration you pass to an instance at launch. On Linux AMIs, cloud-init reads it on the first boot: a file starting with #! runs as a script, and a file starting with #cloud-config is applied as YAML configuration. On Windows Server, EC2Launch v2 runs the code inside <powershell> tags. In both cases it runs as an administrator (root or Local System), without a terminal, so every command must be non-interactive.

This generator builds one plan from your settings and renders it as Bash, Cloud-Init or PowerShell, so the formats never drift apart and never mix. Packages are mapped to the right name for each OS family (for example httpd on Amazon Linux and RHEL, apache2 on Ubuntu) and installed with that OS's package manager: dnf, yum, apt or zypper. Tools that distributions do not package well — AWS CLI v2, kubectl, Helm, the Docker Compose plugin — use their official installers.

A pinned version is passed to the package manager as a pin (nginx=1.24.0-2ubuntu7 for apt, nginx-1.24.0 for dnf) or as a versioned download URL. If the repository does not have that version, the install fails with an error — it never quietly installs a different one. Version data comes from this tool's catalog and is not checked against live repositories, so custom pins are marked unverified.

EC2 accepts at most 16 KB of user data. For anything bigger, keep the user data small and have it download the rest from Amazon S3.

Limitations

  • Package names and versions come from a built-in catalog and are not verified against live repositories, AMIs or regions.
  • Scripts are generated, not tested on a real EC2 instance — launch a test instance first.
  • Windows support covers PowerShell user data with EC2Launch v2; creating Windows users, Docker on Windows and Windows Update are not generated.
  • EBS volumes must be created and attached separately; the storage task only formats and mounts them.

Frequently asked questions

What is EC2 user data?

User data is text you supply when you launch an EC2 instance. On Linux, cloud-init runs it as a shell script (if it starts with #!) or applies it as cloud-config YAML (if it starts with #cloud-config). On Windows Server, EC2Launch runs the PowerShell inside <powershell> tags. It is commonly used to install software and configure the instance on first boot.

Does user data run on every reboot?

No. By default user data scripts and cloud-config run once, on the first boot of the instance. Rebooting, or stopping and starting the instance, does not run them again. You can change this (for example with cloud-init per-boot settings, or persist on Windows), but scripts that run on every boot must be written to be safe to repeat.

How do I install a specific software version?

Select the package, then choose Specific (versions listed in this tool's catalog, installed by package name such as java-21-amazon-corretto-headless) or Custom (an exact version you type). Custom versions are passed to the package manager as a pin — package=version for apt, package-version for dnf and yum — or used in the official download URL. If that version is not available, the install fails instead of installing another version. Check the exact version string first, for example with apt-cache policy or dnf list --showduplicates.

Can I use Ubuntu and Amazon Linux?

Yes. The generator supports Amazon Linux 2023 and 2, Ubuntu 24.04, 22.04 and 20.04, RHEL, Rocky Linux, AlmaLinux, CentOS Stream, Oracle Linux, Debian, SUSE Linux Enterprise Server and Windows Server 2016–2025. Package names and commands change with the OS. Whether a particular AMI exists depends on your region, the CPU architecture and the publisher.

How do I troubleshoot failed user data?

On Linux, connect to the instance and read /var/log/cloud-init-output.log (all output from user data), run cloud-init status --long, and for Bash scripts from this tool read /var/log/user-data.log. On Windows, read C:\ProgramData\ec2-user-data\user-data.log (written by this tool's script) and the EC2Launch v2 log at C:\ProgramData\Amazon\EC2Launch\log\agent.log. You can also view the console output from the EC2 console.

Is it safe to store secrets in user data?

No. Anyone with permission to describe the instance attribute can read user data, and any process on the instance can fetch it from the instance metadata service. Store secrets in AWS Systems Manager Parameter Store or AWS Secrets Manager and fetch them at runtime using an IAM role. Never put AWS access keys in user data — attach an instance profile instead.