Windows server farm on AWS/EC2

Windows server farm on AWS/EC2

We'll be deploying our application infrastructure (primarly Windows with
some Linux components) on AWS/EC2 VPC. We'll be using Chef to handle
provisioning and administration.
However, unlike Linux machines, Windows machines don't have SSH built-in
and one is forced to resort to other methods of authenticating to get
administrator access.
What's the best way to automatically grant our Chef server access to the
Windows box? Some of the methods I found:
Include a default password in the user-data script of the instance
This seems insecure, then again, these computers are inside a private
subnet of a VPC
Setup a domain controller server to manage all the computers
Research should that managing a Windows domain on EC2 can be a headache
due to the possibility of losing EC2 machines randomly. This also seems
like an unnecessary overhead for managing credentials of machines that
will be added/removed frequently.