Q:

Configure credentials on Amazon EC2 depoyment

I created a custom Linux AMI with all I need to run my PHP app (basically a node that does batch processing of images/video/audio). There can be n amount of instances running at the same time. So far it deploys and works fine. 
My only concern is that I had to hardcode a few MySQL DB credentials, FTP passwords, and other things that might change in the future. I have other servers where these credentials could be made available (outside Amazon's network) but I'm not sure hot to get these credentials into the EC2 instance after I start it up. These should be easy and secure for a new EC2 instance to get but not for anybody else.

A:

In short, this is what you can do:

Create an IAM Role for use by your EC2 instances
Upload your credentials to one or several S3 objects, and give your new role read access.
Change your Linux AMI to run a program or script to get the credentials from S3 and put them where you want on start up. This will need to use the role credentials, which are stored in the instance's profile.  The AWS PHP SDK can do this for you.
When you launch your instances, make sure you indicate that you want to use your new role.

I've started to use CloudFormation which seems a little better for my needs, but requires more setup. 

