I am building a lamp server ec2 image for a project we are doing. These images will be in an autoscaling group and on startup will be running startup script. THere are some config files that have details that need to be kept secure, for example database login details.
I was originally planning to run a phpscript to retrieve these files from an S3 bucket, however when I was reading about credentials for the instance to access the S3 server, the documentation advised that the security credentials should not be stored on S3, even if it is encrypted. I'm not using a credential file anyway, as I have assigned a IAM role to the ec2, however, this advice has made me think, well it's not secure to store these config files on S3 also.
So I'm just asking, what is the best practice for storage of config files for instances that have to be spun up. Should I just make these config files part of the image I'm creating? Or is there a reason I should not do that either?