Thanks Alberto!
You can certainly set up permissions and security groups on EC2 nodes using CloudFormation, run your job, and then tear down the CloudFormation stack. You can use stratosphere to specify the AWS resources like an EC2 instance, a VPC for it, some security groups, and an instance role. Then, you can use something like Ansible or even just a bash script to set up and run your job on that machine. Once it's done, you can tear down the stack you just built.
We actually do something similar to what you said for running pgbadger on our Postgres RDS logs. Our logs can reach a few GB per hour, so downloading them to a local machine can be pretty time-consuming, and processing can take long as well. In order to get RDS logs, you need to have permissions to do so on AWS. I made a stack in stratosphere that creates a large EC2 instance for processing, a strict security group that locks down the instance, and also sets up a temporary user that only has permission to download RDS logs. Using Ansible, I then install pgbadger and its dependencies, download the logs, run pgbadger, and then download the results. Once the job is done, everything that was just created is destroyed.
In summary, what you're saying is indeed possible and is a great use-case for CloudFormation. You just need to using something on top of stratosphere, as this library is simply used to build the CloudFormation templates. I'm considering adding support for running the templates directly in this library, maybe using amazonka-cloudformation. So far that hasn't been necessary for us.