title: What's the best method for passing AWS credentials as user data to an EC2 instance?
body: <p>I have a job processing architecture based on AWS that requires EC2 instances query S3 and SQS.  In order for running instances to have access to the API the credentials are sent as user data (-f) in the form of a base64 encoded shell script. For example:</p>
  
  <pre><code>$ cat ec2.sh
  ...
  export AWS_ACCOUNT_NUMBER='1111-1111-1111'
  export AWS_ACCESS_KEY_ID='0x0x0x0x0x0x0x0x0x0'
  ...
  $ zip -P 'secret-password' ec2.sh
  $ openssl enc -base64 -in ec2.zip
  </code></pre>
  
  <p>Many instances are launched...</p>
  
  <pre><code>$ ec2run ami-a83fabc0 -n 20 -f ec2.zip
  </code></pre>
  
  <p>Each instance decodes and decrypts ec2.zip using the 'secret-password' which is hard-coded into an init script.  Although it does work, I have two issues with my approach.</p>
  
  <ol>
  <li>'zip -P' is not very secure</li>
  <li>The password is hard-coded in the instance (it's always 'secret-password')</li>
  </ol>
  
  <p>The method is very similar to the one described <a href="http://blogs.oracle.com/ec2/entry/using_parameterized_launches_to_customize" rel="noreferrer">here</a></p>
  
  <p>Is there a more elegant or accepted approach?  Using gpg to encrypt the credentials and storing the private key on the instance to decrypt it is an approach I'm considering now but I'm unaware of any caveats.  Can I use the AWS keypairs directly?  Am I missing some super obvious part of the API?  </p>