I want to host a EC2 instance on a different user's account while keeping all shell access to myself. I can just create the instance and keep the private key, but according to https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html#replacing-lost-key-pair, the owner of the AWS account where the EC2 instance is stored can recover the key by detaching and reattaching the root volume to a new instance.
My idea is to encrypt the volume (by creating a snapshot of the volume, encrypt it using my own personal KMS key - here giving temporary access to the new user, and attaching it to the EC2 instance) and then revoke access to the KMS key from the new user. I've tried the detach and reattach method outlined by the aforementioned link after revoking KMS key access, and an error occurs (Client.InternalError: Client error on launch) when starting the new instance (which has the encrypted volume attached) - which I want.
My question is, is this a valid way of accomplishing what I want - Hosting an EC2 instance on a different user account while preventing shell access completely?