Look into using EC2 instance metadata when available.

[danfuzz]

See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-metadata-v2-how-it-works.html for the "fun" bits required now that the local-data URL requires token-based access.

…But… you can get a token just by asking? Not clear why this makes anything better.

TOKEN=`curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"`

[danfuzz]

FWIW Here's my ancient script that is arguably salient but probably doesn't actually work.

get-auth-credentials.txt