I have a regular EC2 instance with an elastic IP. The few times the instance has been stopped, I've just manually re-associated the IP with it via the AWS Management console. I'm now thinking about migrating it to a spot instance, which means I want a way of automatically re-associating it the IP on startup if/when the machine is shutdown due to being priced out of the market. How to achieve this is well described in numerous places (e.g here).
My question is:
Like many people with this problem, I'm wary of putting my AWS credentials file on the instance itself. I have a vague memory of seeing something about it being possible to create additional keys with more limited permissions, but am having trouble finding any concrete details. So: is it possible to create a key which I can happily put on the machine knowing it can be used for little more than an ec2-associate-instance (but not login to other instances, or generally running riot with my AWS account), and how would I actually achieve this ?