What is EC2 user data and how is it different from instance metadata?
User data is a script or text you give an instance at launch, typically run once to install software. Instance metadata is information about the running instance, such as its ID, IP and IAM role credentials, which the instance reads from a local endpoint.
Explain it simply
User data is the instruction sheet you hand a new employee on day one: install these tools, then start work. Metadata is the ID card pinned on them, saying who they are, which desk they sit at and what they are allowed to access.
Example
#!/bin/bash
# User data: runs at first boot as root
dnf install -y nginx
systemctl enable --now nginx# Metadata: read from inside the instance (IMDSv2 uses a token)
TOKEN=$(curl -s -X PUT http://169.254.169.254/latest/api/token \
-H "X-aws-ec2-metadata-token-ttl-seconds: 60")
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" \
http://169.254.169.254/latest/meta-data/instance-idUser data goes in at launch and is limited to 16 KB. Metadata comes out from the address 169.254.169.254, available only from inside the instance. Prefer IMDSv2, the token-based version, because it blocks many request-forgery attacks. Never place passwords in user data; anyone who can read the instance's configuration can read it.
What to say in the interview
"User data is a launch-time script, by default run once, used for bootstrapping. Instance metadata is read-only information about the instance served at 169.254.169.254. I require IMDSv2 and keep secrets out of user data."
Common mistakes
- Putting secrets in user data.
- Expecting user data to re-run on every reboot by default.