Another option would be to look for nix-shell shebang, like

       #! /usr/bin/env nix-shell
       #! nix-shell -i runghc --packages 'haskellPackages.ghcWithPackages (ps: [ps.download-curl ps.tagsoup])'

in the init script where we determine the type in amazon-init.nix and run it with nix-shell instead of ${pkgs.runtimeShell}

you can also build your own ami. there are instructions in https://github.com/nixos/amis

But I highly advise against building NixOS configs with secrets in them. The nix store is world-readable and not a suitable place for storing any kind of secret.

Secrets should either be avoided (by using IAM roles) or should be a runtime concern and fetched with said IAM roles

you can also build your own ami. there are instructions in https://github.com/nixos/amis

But I highly advise against building NixOS configs with secrets in them. The nix store is world-readable and not a suitable place for storing any kind of secret.

Secrets should either be avoided (by using IAM roles) or should be a runtime concern and fetched with said IAM roles from a dedicated secrets manager like SSM parameter store, AWS SecretsManager, or something like OpenBao or Vault

In reply to @adam:robins.wtf
I wrote a simple module that will pull a secret down with the CLI given an ARN and some permissions. Creates a basic dir in /run to avoid storing them on disk

might be easier to write a systemd unit (e.g. oneshot + optional timer or ExecStartPre) which does the credential pull than relying on boot user scripts.

Ideally the boot userscript just does a nixos-rebuild switch --flake {flake URL} and nothing else