I see a lot of useful information in the previous answer, but just want to give a very brief response to the original question.

User data is executed during the Final stage of the cloud-init tool process. There are five stages: Detect, Local, Network, Config, and Final. The last one is where your user_data script(s) run. This usually includes

• package installations
• configuration management plugins (Ansible, Puppet, Chef, salt-minion), and
• user-defined scripts (i.e., shell scripts passed as user-data).

You can read more here.

So the user_data script(s) run not before or after, but during the Final stage of cloud-init.