diff --git a/roles/aws/aws_ec2_with_eip/tasks/main.yml b/roles/aws/aws_ec2_with_eip/tasks/main.yml
index 37ef61a20..8ea7ff187 100644
--- a/roles/aws/aws_ec2_with_eip/tasks/main.yml
+++ b/roles/aws/aws_ec2_with_eip/tasks/main.yml
@@ -113,7 +113,7 @@
     instance_type: "{{ aws_ec2_with_eip.instance_type }}"
     instance_role: "{{ _aws_ec2_with_eip_iam_role_info.iam_roles[0].instance_profiles[0].arn }}"
     region: "{{ aws_ec2_with_eip.region }}"
-    user_data: "{{ lookup('ansible.builtin.template', 'user-data-debian.sh.j2') }}"
+    user_data: "{{ lookup('ansible.builtin.template', 'cloud-config-debian.j2') }}"
     image_id: "{{ _aws_ec2_with_eip_ami_images.images[-1].image_id }}"  # [-1] is the last item, which is alway latest released
     state: "{{ aws_ec2_with_eip.state }}"
     wait: true
diff --git a/roles/aws/aws_ec2_with_eip/templates/cloud-config-debian.j2 b/roles/aws/aws_ec2_with_eip/templates/cloud-config-debian.j2
new file mode 100644
index 000000000..6a96e5c14
--- /dev/null
+++ b/roles/aws/aws_ec2_with_eip/templates/cloud-config-debian.j2
@@ -0,0 +1,21 @@
+#cloud-config
+repo_update: true
+repo_upgrade: all
+packages:
+  - python3-venv
+  - python3-debian
+
+users:
+  - name: {{ _ce_provision_username }}
+    primary_group: {{ _ce_provision_username }}
+    homedir: /home/{{ _ce_provision_username }}
+    system: true
+    shell: /bin/bash
+    sudo: "ALL=(ALL) NOPASSWD:ALL"
+    ssh_authorized_keys:
+      - {{ aws_ec2_with_eip.pubkey }}
+
+runcmd:
+  - [ su, -, {{ _ce_provision_username }}, -c, "/usr/bin/python3 -m venv /home/{{ _ce_provision_username }}/ce-python" ]
+  - [ su, -, {{ _ce_provision_username }}, -c, "/home/{{ _ce_provision_username }}/ce-python/bin/python3 -m pip install --upgrade pip" ]
+  - [ su, -, {{ _ce_provision_username }}, -c, "/home/{{ _ce_provision_username }}/ce-python/bin/pip install ansible netaddr python-debian" ]