People lose and misplace AWS credentials all the time. To wit: http://www.techspot.com/news/56127-10000-aws-secret-access-keys-carelessly-left-in-code-uploaded

People lose and misplace AWS credentials all the time. To wit: http://www.techspot.com/news/56127-10000-aws-secret-access-keys-carelessly-left-in-code-uploaded-to-github.html http://www.techspot.com/news/56127-10000-aws-secret-access-k... So getting somebody's AWS credential is a lot easier than it sounds. The obstacles you mentioned are generally granted to any IAM User which has ec2 RunInstances privilege: * Can associate an instance with a security group * Can put an instance in a VPC * Can reach the internet from an instance The security group and VPC settings don't need to be modified, the box just needs to be placed appropriately. EC2 Security Groups in a VPC can restrict outbound traffic, but EC2 "classic" Security Groups only restrict inbound traffic. To me this seems like a lot of holes to have to close in order to gain the convenience of using tags for DNS.