Comment by nyrikki

To add to the other responses, cloud-init is also not a secure delivery mechanism, you shouldn’t be using it to deliver sensitive information, but you could use it to kick off scripts that access more appropriate mechanisms, like in AWS where you can access a local URL to obtain instance credentials.