Cannot Gerrit using iam server roles?  This is ideal if supported because the credentials are available via the EC2 meta-data service and can be updated auto-magically.