[nuker]

> You can't really serialize something like an ami.

Copy AMI to separate AWS account, not in your Org, and keep keys to that account offline.

[dougpa]

oooo true, that does invalidate my point. AMI's are very easy to copy-over across accounts, i.e. to a potentially firewalled account.