Connect to EC2 only as needed

This allows the script to run silently, after image creation, on
instances that use the generated image, but otherwise have no
credentials to themselves.