Unless amazon have homomorphic encryption services how exactly will you be able to do something with the vm without having the keys in memory? NSA just have to wait to fire it up.