Push user data to S3 first and use a signed URL to bootstrap from, thus avoiding leaving sensitive data in the user_data field forever.