Windows Username/Password Injection into CloudFormation

Both are good options. S3 has been widely adopted for passing long credentials (e.g. keys) to CloudFormation stacks, however there is another option now; KMS. Benefits of this approach include an audit trail of decryptions, automated rotation of password encryption and not having to use an entire S3 bucket.

The following is an example of how KMS encrypted content can be referenced from a Mapping and an IAM role used by the instance in question to decrypt the key:

"Mappings": {
       "KMSSecrets": {
            "GithubSSHKey": {
                "CMKRegion": "us-east-1",
                "CipherTextBlob": "CiAKP2NjuykOmiYWxqmifMaTak0q.........",
                "IAMRoleName": "tmaddox-githubconsumer"
            }
      }
},
"Resources":
         "IAMInstanceProfileWWW": {
            "Properties": {
                "Path": "/",
                "Roles": [{"Fn::FindInMap": [ "KMSSecrets", "GithubSSHKey", "IAMRoleName"]}]
            },
            "Type": "AWS::IAM::InstanceProfile"
        },
        "WWWAdminServer": {
            "Metadata": {
                "AWS::CloudFormation::Init": {"config": {"packages": {"yum": {
                    "git": []
                }}}}
            },
            "Properties": {
                "IamInstanceProfile": {"Ref": "IAMInstanceProfileWWW"},
                ...
                "UserData": {"Fn::Base64": {"Fn::Join": [ "", [
                        "#!/bin/bash\n",
                        "yum update -y\n",
                        "echo -e \"\n### Running cfn-init\"\n",
                        "/opt/aws/bin/cfn-init",
                        "    -s ",
                        {"Ref": "AWS::StackName"},
                        "    -r WWWAdminServer ",
                        "    --region ",
                        {"Ref": "AWS::Region"},
                        "\n",
                        "",
                        "echo -e \"\n### Saving Github's SSH Host Key\"\n",
                        "GITHUB_HOST_KEY='github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=='\n",
                        "if [ ! -f /root/.ssh/known_hosts ] || grep -v $GITHUB_HOST_KEY /root/.ssh/known_hosts; then\n",
                        "  echo $GITHUB_HOST_KEY >> /root/.ssh/known_hosts\n",
                        "fi\n",
                        "",
                        "echo -e \"\n### Fetching code\"\n",
                        "echo '", {"Fn::FindInMap": [ "KMSSecrets", "GithubSSHKey", "CipherTextBlob" ]}, "'",
                        "    | base64 -d > /root/.ssh/github.pem.encrypted\n",
                        "aws kms decrypt",
                        "    --output text",
                        "    --query Plaintext",
                        "    --region ", {"Fn::FindInMap": ["KMSSecrets", "GithubSSHKey", "CMKRegion" ]},
                        "    --ciphertext-blob fileb:///root/.ssh/github.pem.encrypted",
                        "    | base64 -d > /root/.ssh/git.pem\n",
                        "",
                        "rm -f /root/.ssh/github.pem.encrypted\n",
                        "chmod 600 /root/.ssh/git.pem\n",
                        "rm -rf /var/www/html\n",
                        "eval `ssh-agent`\n",
                        "ssh-add /root/.ssh/git.pem\n",
                        "git clone https://github.com/magento/magento2.git /var/www/html\n",
                        "rm -f /root/.ssh/git.pem\n",
                        ""
                    ]
                ]}}
            },
            "Type": "AWS::EC2::Instance"
        },