I'm considering using EC2 Spot Instances in an automated fashion (ie create a script that will request EC2 Spot Instances that will run unattended).
For this specific use case, I'm happy to lock down the security group such that there are no incoming connections allowed on the Spot Instances.
The only output of the script is to communicate with an RDS server.
I'm after a solution that allows me to spin up a request for a spot instance, and load the software required, including access to a database living on the RDS.
My primary concern is how to deliver the code in a secure way (including the DB Credentials).
What are the security concerns that need to be considered, and which method will provide the lowest risk?
My thoughts so far:
Having no incoming connections should mitigate common threats
Passing data to EC2 user-data is still a risk (storing passwords, or access to code doesn't sound like a good idea to me)
In user-data, supply private details via S3 link that is set to expire (difficult to do with spot instances as I don't know when the Instance will be created)
Create script to limit access to user-data
Do I need to think of a more elaborate way to get data back from the newly created spot instance, and then log into said instance and send data via ssh?