[Enhancement]: Add unencoded user_data field for aws_launch_template resource

[shaul75]

Description

Dear Terraform AWS provider maintainers,

I would like to suggest an enhancement to the aws_launch_template resource.

Currently, the user_data field for the aws_launch_template resource must be base64-encoded, which aligns with the AWS API but creates challenges in terms of human readability and understanding the real changes when looking at terraform plan output. This is in contrast to the aws_instance resource that allows providing unencoded user data.

Consider the following scenario:

locals {
  user_data = templatefile("${path.module}/user_data.sh", { environment = var.environment })
}

resource "aws_launch_template" "example" {
  name_prefix   = "example"
  image_id      = data.aws_ami.example.id
  instance_type = "t2.micro"

  user_data = base64encode(local.user_data)
  ...
}

In this scenario, a developer changes the environment variable:

variable "environment" {
  default = "staging"  # was previously "production"
}

Then runs terraform plan:

~ user_data = "eyJlbnZpcm9ubWVudCI6InByb2R1Y3Rpb24ifQ==" -> "eyJlbnZpcm9ubWVudCI6InN0YWdpbmcifQ=="

The plan shows that the base64-encoded user_data will change, but it's impossible for the developer to discern what specifically has changed in the user data script without decoding the base64 data.

By contrast, with the aws_instance resource:

resource "aws_instance" "example" {
  ami           = data.aws_ami.example.id
  instance_type = "t2.micro"

  user_data = local.user_data
  ...
}

When the developer changes the variable and runs terraform plan, they see the meaningful diff:

~ user_data = "environment=production" -> "environment=staging"

I propose adding a similar user_data field to the aws_launch_template resource, or alternatively, introducing an optional boolean flag that instructs Terraform to base64-encode the provided user_data.

Affected Resource(s) and/or Data Source(s)

• aws_launch_template

Potential Terraform Configuration

No response

References

No response

Would you like to implement a fix?

None

[github-actions[bot]]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[g-psantos]

To minimize disruption to existing configurations, the provider could expose a new attribute (e.g., user_data_raw) that, when specified by the user, is automatically encoded with base64 into user_data.