diff --git a/main.tf b/main.tf
index 572089d..25bdaa7 100644
--- a/main.tf
+++ b/main.tf
@@ -27,19 +27,17 @@ data "aws_ami" "ondemand" {
 
 data "aws_region" "current" {}
 
-data "template_file" "userdata" {
-  template = file("${path.module}/userdata.tpl")
-  vars = {
-    bucket      = var.config_bucket_name
-    region      = var.config_bucket_region == "" ? data.aws_region.current.name : var.config_bucket_region
-    license     = var.use_byol ? var.config_bucket_license_file : ""
-    config_file = var.config_bucket_config_file
-  }
-}
-
 locals {
   latest_ami = var.use_byol ? data.aws_ami.byol.id : data.aws_ami.ondemand.id
   ami        = coalesce(var.override_ami, local.latest_ami)
+  userdata   = templatefile("${path.module}/userdata.tpl",
+    {
+      bucket      = var.config_bucket_name
+      region      = var.config_bucket_region == "" ? data.aws_region.current.name : var.config_bucket_region
+      license     = var.use_byol ? var.config_bucket_license_file : ""
+      config_file = var.config_bucket_config_file
+    }
+  )
 }
 
 module "fortigate_password" {
@@ -71,7 +69,7 @@ resource "aws_instance" "this" {
     var.tags, {
       "Name" = var.name
   })
-  user_data              = var.enable_auto_config ? data.template_file.userdata.rendered : ""
+  user_data              = var.enable_auto_config ? local.userdata : ""
   vpc_security_group_ids = [aws_security_group.internal.id]
 
   depends_on = [aws_s3_bucket_object.default_config]