Hrmmm.  So cloud-init requires the system python-boto to be installed, which is much too old to allow authentication via IAM.  I would have to setup a venv and install a newer boto into it in order to make this work properly, is it worth that level of effort?