Encrypt EC2 API call

Question

I have to host an AMI in the Amazon Marketplace. i need to get the type of instance, whenever some user launches the AMI., like if its small medium or large. based on that i need to make some changes in the AMI when its created. I can do this with Amazon API call, to get the instance type, but the problem is that the instances created with the AMI will be started by other users, and i cannot use my AWS Credentials in the Amazon API.

Is there any way that i can create an anonymous readonly user to make only specific type of EC2 API Calls? Or can i encrypt my EC2 API credentials, so no one can use it?

Answer 1

If you just need the instance-type then you can write code/script which browse the URL 'http://169.254.169.254/latest/meta-data/instance-type' which returns the instance-type. It doesn't requires AWS account credentials.

Ref: http://docs.amazonwebservices.com/AWSEC2/2008-12-01/DeveloperGuide/index.html?AESDG-chapter-instancedata.html

Answer 2

You can use IAM to create a read-only user. This is simple, you need to create the user in IAM via the AWS console, then you need to assign it a Policy, the policy should say it's a read-only user.