To step through this recipe, you will need:

To upgrade all the packages right after bootstrap, simply set the package_upgrade directive to true:

#cloud-config
package_upgrade: true

Another useful directive is to reboot the system if required by the package manager (common case with kernel updates). It's often better to reboot as soon as possible with the most secure kernel, but proceed with caution according to your own environment (you might not want to reboot while another action is taking place, maybe a Chef run or similar management software):

apt_reboot_if_required: true

To ensure the required packages are installed, use the packages directive:

packages:
  - htop
  - nmap
  - curl
  - wget

We can also add a custom APT repository using apt_sources:

apt_sources:
  -  source: "ppa:nginx/stable"

Let's launch a new instance and verify it's fully updated, so no updates can be applied:

$ sudo apt-get dist-upgrade
Reading package lists... Done
Building dependency tree
Reading state information... Done
Calculating upgrade... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

Verify our required tools are available:

$ which nmap
/usr/bin/nmap
$ which htop
/usr/bin/htop
$ which curl
/usr/bin/curl
$ which wget
/usr/bin/wget

Good thing! Now we're sure to always have a fully updated system with the required set of tools installed, even our own, right from the beginning.