A company uses EC2 user data scripts that include sensitive values to bootstrap Amazon EC2 instances. A security engineer discovered that these sensitive values are visible to users who should not have access. What is the most secure way to protect the sensitive information used during instance bootstrapping?

Storing sensitive values in AWS Systems Manager Parameter Store as SecureString parameters is the most secure method. SecureString parameters encrypt the values using AWS Key Management Service (KMS) by default, ensuring confidentiality. Granting the EC2 instance role permission to call GetParameters with specific resource ARNs for the SecureStrings follows the principle of least privilege, allowing only authorized instances to retrieve the necessary secrets. This approach centralizes secret management and prevents sensitive data from being directly embedded in user data, which is easily retrievable. Embedding scripts in an AMI and encrypting values with KMS still exposes the encrypted values within the AMI, and managing decryption within the script can be complex. Moving scripts to S3 and encrypting them doesn't solve the problem of how to securely pass decryption keys or sensitive values to the instance. Blocking access to the EC2 instance metadata service is a security measure but doesn't address the secure storage and retrieval of sensitive bootstrapping data itself.