[ctomaybe]

1) Have an EC2 instance with a role-specific IAM Role

2) Create a S3 bucket

3) Write a bucket policy that whitelists specific IAM Roles to specific key paths within the bucket.

[ctomaybe]

4) Put secrets in that bucket (duh)