Require a separate completion signal for cloud-init custom-data work

Source facts

Azure supplies custom data during initial VM provisioning. The cloud-init agent processes it by default, but reports the VM ready without waiting for the user’s custom-data work to finish. Errors while processing that configuration or its scripts do not themselves constitute a fatal provisioning failure. Microsoft advises against placing sensitive values in custom data. Microsoft Learn.

Applicability

Use this review for a Linux image that actually uses cloud-init. Confirm the provisioning agent before applying its readiness behavior to another image. Identify the particular configuration or script whose completion the next deployment step depends on, rather than treating all first-boot work as one unnamed task.

DSE recommendation

Define an explicit completion and failure signal for the custom-data task before allowing dependent deployment steps. Have the image owner specify the expected result, a bounded waiting policy, and the response to an unsuccessful run. Keep secrets out of the payload and review the retained troubleshooting output for unnecessary sensitive content. Make the dependency on successful configuration visible in the deployment design.

Verification

In a permitted test, compare the VM’s platform-ready time with the custom-data task’s actual completion. Include a deliberately unsuccessful configuration case and confirm that the chosen signal prevents dependent work from proceeding. Inspect the resulting application configuration, not only the script’s last message. Preserve the payload version and observations so an image or provisioning-agent change can be tested against the same acceptance criteria.

Official references

Microsoft Learn: Custom data on Azure virtual machines. Source reviewed September 9, 2026.