I'm trying to use EC2 to provide an easy-to-use way to bootstrap a hard-to-build web application. Trouble is, there is some sensitive configuration on the filesystem, such as password salts.
I've written a user-data script that replaces these salts with random values on first boot, and I put this in the user-data attribute of the instance from which I built my AMI.
But now it looks to me like user-data scripts are specific to instances, not AMIs - that is, it's only run when specified by the user doing the cloning, not the creator of the AMI (me).
Well... duh, I guess that makes sense given the name "user data".
Is that wrong? Is there any way for me to provide a script that's run automagically on new clones of my AMI?