More information: it appears that both cloud-config.service and cloud-final.service are disabled, thus rendering cloud-init half usable. That's likely the root cause here, which begs the question: why are those disabled in the official AMIs?

I updated the default systemd presets in base-files to allow for the cloud-init service to run by default.

This is in base-files 1:2020.2.0. Hopefully this will help. But I'm not sure if cloud-init has a good default behaviour on Kali.

Thanks! Cloud-init is de-facto the standard approach for all distributions on AWS, so having it configured and running properly would be a good idea. Ubuntu, Debian, CentOS, and other major have good examples of working cloud-init in their official AMIs. There are other problems that we've been able to identify with the assistance of cloud-init developers, which probably should be addressed at this point:

1) There are three services that need to be enabled:

cloud-init-local.service
cloud-config.service
cloud-final.service

2) Currently cloud-init support for apt assumes presence of 'security' repository, which Kali doesn't have. As a result, starting cloud-config.service breaks because /etc/cloud/cloud.cfg has the following:

   package_mirrors:
     - arches: [default]
       failsafe:
         primary: http://http.kali.org/kali

Cloud-init developers suggested the following workaround, which we've tested and it works:

  package_mirrors:
    - arches: [default]
      failsafe:
        primary: http://http.kali.org/kali
        security: http://http.kali.org/kali

3) This one is less important, but it appears that during the build stage Kali creates user 'kali'. With cloud-init that's typically accomplished via the existing /etc/cloud/cloud.cfg section:

system_info:
   # This will affect which distro class gets used
   distro: debian
   # Default user name + that default users groups (if added/used)
   default_user:
     name: ec2-user
     lock_passwd: True
     gecos: Debian
     groups: [adm, audio, cdrom, dialout, dip, floppy, netdev, plugdev, sudo, video]
     sudo: ["ALL=(ALL) NOPASSWD:ALL"]
     shell: /bin/bash

The existing current setup means the user 'kali' is present at uid 1000, so cloud-init creates another user 'ec2-user' with uid 1001. To follow the convention of the rest of AWS AMIs, there would be no need to create the user 'kali', and just letting cloud-init create an appropriate user. This way consumers can override it easily with user-data.

Thank you so much for your help with this!

I have added a new /etc/cloud/cloud.cfg.d/20_kali.cfg with the appropriate configuration and this package will be installed in the next AMI so that should fix this.

see https://gitlab.com/kalilinux/packages/kali-defaults/-/commit/95cbe90c8c20f9b94c9ad5e569777b3bd12b0596