I just confirmed this can also work using AWS Session Manager (a "secure" and easily-auditable way to provide shell access to EC2 instances):
$ aws ssm start-session --target i-XXXXXX | tee base64.txt