Amazon now provides a service to give you on instance keys: http://aws.amazon.com/iam/faqs/#What_is_IAM_roles_for_EC2_in...

Before that at Netflix we developed a service that would hand out temporary keys to the requestor when they presented a proper certificate.

At reddit we put the secret keys on the instance, which was bad. :)