EC2 now has 2 factor authentication to it's services which is an important first step.
However, anything hosted on a cloud service that you don't own should be considered insecure at best.
The reason being is you have a virtual machine, with shared memory and shared resources.
With EC2, you don't know where the data resides or how it's effectively stored. You may find that your VPS is shared with other VPS's from other organisations.
So if you're going to store financial data on EC2 in an EBS drive you should encrypt it.
But while you might think this is therefore secure, you are only as secure as your weakest link.
To quote another source because he says it well.
... but VM instances often share physical
hardware with other instances, and since EC2 is a public service,
those co-resident VMs may not be entirely friendly. The major threat
here is, of course, software vulnerabilities -- things that can let an
attacker break out of one VM and into another. But even if you perfect
the software, there's another more insidious threat: namely, that the
attacker VM instance could be able to run a side-channel attack on the
Which would make 2 factor authentication useless against this type of attack.
Now if you can live with that, how do you do it?
This stackoverflow question/answer provides you with some answers on using google authenticator which is one of the better ones.
But there are many 2 factor authentication options out there, some require hardware keyfobs and others like google authenticator use your mobile phone. The bank or financial institution may actually mandate which 2 factor authentication method they will allow.
OpenID is a great idea in that it allows you to use your openid to log into many services. But it's also flawed because it allows a single login to gain access to many things. A quick Google and I found http://wikid.com/ which uses OpenID and 2 factor authentication. I'd be hesitant to use it in your particular case.
By the way, are you going to be accepting payments from credit cards?
You may find you need to be PCI compliant and I'm not entirely sure if you will be able to be compliant on an EC2 instance. They are quite strict, but for good reason. There are ways to reduce your risks though by not directly accepting card payments and not storing credit card data but by going through a 3rd party payment provider service that your website can interact with.
If you are a merchant that accepts payment cards, you are required to
be compliant with the PCI Data Security Standard. You can find out
your exact compliance requirements only from your payment brand or
acquirer. However, before you take action, you may want to obtain
background information and a general understanding of what you will
need to do from the information and links here.