diff --git a/assets/aws/files/bin/teleport-all-pre-start b/assets/aws/files/bin/teleport-all-pre-start
index bdfc3be56a848..403572ed14cb5 100755
--- a/assets/aws/files/bin/teleport-all-pre-start
+++ b/assets/aws/files/bin/teleport-all-pre-start
@@ -1,7 +1,7 @@
 #!/bin/bash
 # This script prepares a Letsencrypt certificate before all-in-one Teleport starts for the first time (if needed)
 set -e
-if [[ "${DEBUG}" == "true" ]]; then
+if [[ "${DEBUG:-false}" == "true" ]]; then
     set -x
 fi
 
diff --git a/assets/aws/files/bin/teleport-check-cert b/assets/aws/files/bin/teleport-check-cert
index c134b71f5c043..2111c4b2731ce 100755
--- a/assets/aws/files/bin/teleport-check-cert
+++ b/assets/aws/files/bin/teleport-check-cert
@@ -2,7 +2,7 @@
 
 # This script is called hourly to check if the certificate
 # has been renewed on S3 and if it has been renewed, restart teleport proxies
-if [[ "${DEBUG}" == "true" ]]; then
+if [[ "${DEBUG:-false}" == "true" ]]; then
     set -x
 fi
 
diff --git a/assets/aws/files/bin/teleport-generate-config b/assets/aws/files/bin/teleport-generate-config
index 20a6101a2d9ab..142a34e459d9e 100755
--- a/assets/aws/files/bin/teleport-generate-config
+++ b/assets/aws/files/bin/teleport-generate-config
@@ -1,5 +1,5 @@
 #!/bin/bash
-if [[ "${DEBUG}" == "true" ]]; then
+if [[ "${DEBUG:-false}" == "true" ]]; then
     set -x
 fi
 
diff --git a/assets/aws/files/bin/teleport-get-cert b/assets/aws/files/bin/teleport-get-cert
index d95c2a719c81d..59f8897c90ebd 100755
--- a/assets/aws/files/bin/teleport-get-cert
+++ b/assets/aws/files/bin/teleport-get-cert
@@ -4,7 +4,7 @@
 # to prove to letsencrypt that they own the domain.
 
 set -e
-if [[ "${DEBUG}" == "true" ]]; then
+if [[ "${DEBUG:-false}" == "true" ]]; then
     set -x
 fi
 
diff --git a/assets/aws/files/bin/teleport-lock b/assets/aws/files/bin/teleport-lock
index 45ae55df5f9fd..34d4d293934ec 100755
--- a/assets/aws/files/bin/teleport-lock
+++ b/assets/aws/files/bin/teleport-lock
@@ -3,11 +3,10 @@
 # for example renewing or getting letsencrypt certificates
 
 set -e
-if [[ "${DEBUG}" == "true" ]]; then
+if [[ "${DEBUG:-false}" == "true" ]]; then
     set -x
 fi
 
-
 # Source variables from user-data
 . /etc/teleport.d/conf
 
diff --git a/assets/aws/files/bin/teleport-renew-cert b/assets/aws/files/bin/teleport-renew-cert
index 603f5fecdf5ce..b0d3ec9824a0a 100755
--- a/assets/aws/files/bin/teleport-renew-cert
+++ b/assets/aws/files/bin/teleport-renew-cert
@@ -4,7 +4,7 @@
 # needs renewal, and renews the cert after that
 
 set -e
-if [[ "${DEBUG}" == "true" ]]; then
+if [[ "${DEBUG:-false}" == "true" ]]; then
     set -x
 fi
 
diff --git a/assets/aws/files/bin/teleport-upload-cert b/assets/aws/files/bin/teleport-upload-cert
index 19e7d2c3a24a9..c6c94900fc589 100755
--- a/assets/aws/files/bin/teleport-upload-cert
+++ b/assets/aws/files/bin/teleport-upload-cert
@@ -2,7 +2,7 @@
 # This script is called to upload renewed cert
 # to the S3 bucket
 set -e
-if [[ "${DEBUG}" == "true" ]]; then
+if [[ "${DEBUG:-false}" == "true" ]]; then
     set -x
 fi