An example of how we encrypt our settings files with an OpenSSL cert

encrypt.sh

#!/bin/bash

if [ -z "$1" ]; then
    echo "No configuration specified. Usage: $0 <config>"
    exit 1
fi

CONFIG=$1
KEYFILE=conf/encrypt.crt

openssl smime -encrypt -aes256 -binary -outform PEM \
	-in "$CONFIG" \
	"$KEYFILE" \
	| pbcopy

echo "Encrypted payload copied to your clipboard"

user-data.sh

#!/bin/bash

SECURE_FILE=/home/ec2-user/settings.enc
DESTINATION=/home/ec2-user/settings.properties
KEY_FILE=/home/ec2-user/decrypt.pem

cd /home/ec2-user

# Setup our Instance ID and Lane tag from AWS
cat <<EOF >> /home/ec2-user/.bash_profile
export INSTANCE_ID=`wget -q -O - http://169.254.169.254/latest/meta-data/instance-id`
EOF

# Create our encrypted file
cat <<EOF >> "$SECURE_FILE"
-----BEGIN PKCS7-----
[ENCRYPTED_PAYLOAD_HERE]
-----END PKCS7-----
EOF

# Decrypt our file (using the box's PK)
sudo -u ec2-user openssl smime -decrypt -inform PEM -binary -in "$SECURE_FILE" -inkey "$KEY_FILE" -out "$DESTINATION"
rm "$SECURE_FILE"

A little snippit to get you started with the CLI tools

# Generate our cert and key
openssl req -x509 -days 10000 -newkey rsa:2048 -keyout key.pem -out setup.crt -subj '/'
# Strip the password off the key
openssl rsa -in key.pem -out key.pem
# Encrypt our file
openssl smime -encrypt -aes256 -binary -outform PEM -in file.txt -out file.aes setup.crt
# Decrypt our file
openssl smime -decrypt -inform PEM -binary -in file.aes -inkey key.pem -out decrypted.txt