initial cut at ec2_credential spec