https://www.toger.us/posts/extending-aws-instance-trust/