Detects mass retrieval of EC2 user data via DescribeInstanceAttribute for the userData attribute. When a single AWS principal (aws.cloudtrail.user_identity.arn) from the same source IP reads userData for more than 20 distinct instances within a 10-minute window, it indicates potential reconnaissance or credential harvesting, as userData often contains bootstrap scripts or embedded credentials. The rule excludes known CSPM roles, AWS service invocations, and Terraform activity from common networks. The detection aggregates by principal ARN/type, source IP/ASN, and collects the corresponding instanceId values to surface suspicious fleet-wide access patterns.