[ecnahc515]

You can also use a signing proxy.

[luhn]

I wasn't aware of that option. I'll look into it.

[Leon]

A simple solution in this vein is to white list your the EIP addresses of your NAT. This would give access to all resources in a private subnet (this is useful for Lambda's running in subnets).