Right now, we only use EC2 on-demand instances, and we provision sensitive data (credentials, private keys, etc.) on the instances' EBS which are encrypted with a KMS key.
My understanding is that I have a few ways to pass those secret data to Spot instances:
- Burn them in an encrypted AMI (but then, what about host-specific stuff, like SSH server private keys?)
- Pass them as UserData when we call RunInstances (but then we would need to encrypt those data, and decrypt them with a secret burnt in the AMI)
- Use Secrets Manager, but that could quickly cost a lot...
- Use Parameter Store, and encrypt the payload with a KMS key (1 shared key for shared data + 1 key per node for node specific data?)
And I am not sure I could individually identify spot instances?
Am I missing something there? How do you solve those challenges?