On Amazon Linux AMIs, set a password on the built-in ec2-user account and require it when using sudo(8).