Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I created a custom Linux AMI with all I need to run my PHP app (basically a node that does batch processing of images/video/audio). There can be n amount of instances running at the same time. So far it deploys and works fine.

My only concern is that I had to hardcode a few MySQL DB credentials, FTP passwords, and other things that might change in the future. I have other servers where these credentials could be made available (outside Amazon's network) but I'm not sure hot to get these credentials into the EC2 instance after I start it up. These should be easy and secure for a new EC2 instance to get but not for anybody else.

share|improve this question
up vote 1 down vote accepted

In short, this is what you can do:

  1. Create an IAM Role for use by your EC2 instances
  2. Upload your credentials to one or several S3 objects, and give your new role read access.
  3. Change your Linux AMI to run a program or script to get the credentials from S3 and put them where you want on start up. This will need to use the role credentials, which are stored in the instance's profile. The AWS PHP SDK can do this for you.
  4. When you launch your instances, make sure you indicate that you want to use your new role.

I've started to use CloudFormation which seems a little better for my needs, but requires more setup.

share|improve this answer

The Amazon Linux AMI supports setting up a 'user-data' script which will be passed securely to the VM when it starts.

Quoting from here:

The Amazon Linux AMI contains a customized version of cloud-init. It enables you to specify actions that should happen to your instance at boot time. You can pass desired actions to cloud-init through the user data fields when launching an instance. This means you can use common AMIs for many use cases and configure them dynamically at startup.

So when you start you instance, you pass the user-data script. For instance:

ec2-run-instances --key KEYPAIR --user-data-file custom-env-file ami-xxxxxx

In your case, you can pass the required credentials in the user-data file and save them in a known location on the instance. Your app can pick them up from there.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.