I am looking for where the default Amazon AMI linux image sets up the privileges for the default ec2-user account.

After logging in with this account I can use sudo successfully. Checking via the sudoers file, which I open by running visudo (with no other options) I see a few default settings and permissions for root ALL ALL

So ... Where is the permissions for ec2-user assigned?

I have not yet tried to add a new permission but ultimately I want to resign ec2-user for systems management tasks and use a non-full root user for administering the applications (stop and start mysql, httpd, edit apache's vhost files, and upload / edit web content under the web root)

2 Answers 2


It's in /etc/sudoers.d/cloud-init. I, too, delete it from my production systems as soon as I can.

It is included by virtue of the line

#includedir /etc/sudoers.d

in the /etc/sudoers file. Note that, as it says, that leading # isn't treated as a comment sign. On some of my servers, it's also in /etc/sudoers.d/90-cloud-init-users; it may be safest to userdel the ec2-user user.

  • Yes it is. Now why don't you fix your answer so that I can award you the credit?
    – Johan
    May 29, 2014 at 9:06
  • 1
    What on earth were the sudo devs thinking with that #include syntax when the comment character is #?
    – DaveGauer
    May 19, 2018 at 23:02
  • 1
    @DaveGauer it's using the same syntax as a C preprocessor (#include "file" or #include <stdio.h>). But yes, that's a bad choice for a config file. Jun 29, 2018 at 21:38

Indeed it is a file from /etc/sudoers.d/

From the master sudoers file, the very last part:
## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
#includedir /etc/sudoers.d

Specifically the small bit which reads # here does not mean a comment

And then:

[root@webmaster ec2-user]# cd /etc/sudoers.d/
[root@webmaster sudoers.d]# ls -l
total 4
-r--r----- 1 root root 88 May  5 09:16 cloud-init
[root@webmaster sudoers.d]# grep ec2-user *
ec2-user ALL = NOPASSWD: ALL
# User rules for ec2-user


  • Hi, I did this and now it's PWD protected.. how I remove?
    – FilipeOS
    Jul 6 at 1:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.