"Who Am I?"
When you launch a generic Linux virtual machine — say, an Ubuntu image on AWS — the operating system starts up with no knowledge of its environment. It doesn't know its hostname, its IP address, which SSH keys to trust, or what software it's supposed to run. Every instance starts from the same blank slate.
Cloud-Init is the industry-standard software that runs during the very first boot to answer these questions. Think of it like a hospital intake form: before a patient can be treated, a nurse reads the chart and configures the room — adjusts the bed, sets up the IV, labels the wristband. Cloud-init is that nurse. The "chart" is whatever instructions you provided when you launched the instance.
Where Cloud-Init Gets Its Instructions — Datasources:
Cloud-init looks for configuration from a datasource. On AWS, GCP, and Azure, this is a special internal HTTP server reachable at the link-local IP address 169.254.169.254 — sometimes called the Instance Metadata Service (IMDS). This address is not routable on the public internet; it only responds to requests originating from within the VM itself.
When the VM boots, cloud-init queries that metadata service for its hostname, the SSH public key it should trust, and the user-data blob the operator attached at launch. From these responses it learns: "My hostname should be ip-10-0-1-42, I should trust this SSH public key, and here are the setup instructions the operator left for me."
Cloud-init is not AWS-specific. It supports over a dozen datasources including GCP, Azure, OpenStack, DigitalOcean, Hetzner, and even local NoCloud (a file on a mounted ISO or seed directory), making it the universal bootstrap layer across virtually all Linux cloud images.
The security implication of IMDS: Because 169.254.169.254 is reachable by any process on the instance, a web application with a Server-Side Request Forgery (SSRF) vulnerability can be exploited to retrieve IAM credentials from the metadata service. AWS IMDSv2 mitigates this by requiring a session token obtained via a PUT request before any metadata can be read — a defense that SSRF attacks cannot easily replicate. When hardening instances, always enforce IMDSv2.