Andy said:

I'd probably just create a new user and lock the "ubuntu" user.

Is this something that cloud-init can be told not to do?

Certainly when I last started a Ubuntu VPS with 'a big US-based VPS vendor', it only came up with root rather than ubuntu as well.

If you could change it not to have a default user, it would be good...

Ian