diff --git a/apis/ec2/src/main/java/org/jclouds/ec2/compute/config/EC2ComputeServiceDependenciesModule.java b/apis/ec2/src/main/java/org/jclouds/ec2/compute/config/EC2ComputeServiceDependenciesModule.java
index 462ecfc3a1..c21b1eca16 100644
--- a/apis/ec2/src/main/java/org/jclouds/ec2/compute/config/EC2ComputeServiceDependenciesModule.java
+++ b/apis/ec2/src/main/java/org/jclouds/ec2/compute/config/EC2ComputeServiceDependenciesModule.java
@@ -64,6 +64,7 @@ import org.jclouds.predicates.RetryablePredicate;
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.base.Function;
 import com.google.common.base.Functions;
+import com.google.common.base.Optional;
 import com.google.common.base.Predicate;
 import com.google.common.cache.CacheBuilder;
 import com.google.common.cache.CacheLoader;
@@ -117,7 +118,7 @@ public class EC2ComputeServiceDependenciesModule extends AbstractModule {
       bind(TemplateBuilder.class).to(EC2TemplateBuilderImpl.class);
       bind(TemplateOptions.class).to(EC2TemplateOptions.class);
       bind(ComputeService.class).to(EC2ComputeService.class);
-      bind(new TypeLiteral<CacheLoader<RunningInstance, LoginCredentials>>() {
+      bind(new TypeLiteral<CacheLoader<RunningInstance, Optional<LoginCredentials>>>() {
       }).to(CredentialsForInstance.class);
       bind(new TypeLiteral<Function<RegionAndName, KeyPair>>() {
       }).to(CreateUniqueKeyPair.class);
@@ -154,7 +155,7 @@ public class EC2ComputeServiceDependenciesModule extends AbstractModule {
 
    @Provides
    @Singleton
-   protected LoadingCache<RunningInstance, LoginCredentials> credentialsMap(CacheLoader<RunningInstance, LoginCredentials> in) {
+   protected LoadingCache<RunningInstance, Optional<LoginCredentials>> credentialsMap(CacheLoader<RunningInstance, Optional<LoginCredentials>> in) {
       return CacheBuilder.newBuilder().build(in);
    }
 
diff --git a/apis/ec2/src/main/java/org/jclouds/ec2/compute/functions/CredentialsForInstance.java b/apis/ec2/src/main/java/org/jclouds/ec2/compute/functions/CredentialsForInstance.java
index e80504bf8b..37175295e6 100644
--- a/apis/ec2/src/main/java/org/jclouds/ec2/compute/functions/CredentialsForInstance.java
+++ b/apis/ec2/src/main/java/org/jclouds/ec2/compute/functions/CredentialsForInstance.java
@@ -34,6 +34,7 @@ import org.jclouds.ec2.domain.RunningInstance;
 
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.base.Function;
+import com.google.common.base.Optional;
 import com.google.common.base.Supplier;
 import com.google.common.cache.CacheLoader;
 import com.google.common.cache.LoadingCache;
@@ -43,7 +44,7 @@ import com.google.common.cache.LoadingCache;
  * @author Adrian Cole
  */
 @Singleton
-public class CredentialsForInstance extends CacheLoader<RunningInstance, LoginCredentials> {
+public class CredentialsForInstance extends CacheLoader<RunningInstance, Optional<LoginCredentials>> {
 
    private final ConcurrentMap<RegionAndName, KeyPair> credentialsMap;
    private final Supplier<LoadingCache<RegionAndName, ? extends Image>> imageMap;
@@ -58,13 +59,13 @@ public class CredentialsForInstance extends CacheLoader<RunningInstance, LoginCr
    }
 
    @Override
-   public LoginCredentials load(final RunningInstance instance) throws ExecutionException {
+   public Optional<LoginCredentials> load(final RunningInstance instance) throws ExecutionException {
       if ("windows".equals(instance.getPlatform())) {
-         return passwordCredentialsFromWindowsInstance.apply(instance);
+         return Optional.of(passwordCredentialsFromWindowsInstance.apply(instance));
       } else  if (instance.getKeyName() != null) {
-         return LoginCredentials.builder().user(getLoginAccountFor(instance)).privateKey(getPrivateKeyOrNull(instance)).build();
+         return Optional.of(LoginCredentials.builder().user(getLoginAccountFor(instance)).privateKey(getPrivateKeyOrNull(instance)).build());
       }
-      return null;
+      return Optional.absent();
    }
 
    @VisibleForTesting
diff --git a/apis/ec2/src/main/java/org/jclouds/ec2/compute/strategy/EC2CreateNodesInGroupThenAddToSet.java b/apis/ec2/src/main/java/org/jclouds/ec2/compute/strategy/EC2CreateNodesInGroupThenAddToSet.java
index ce0133b4bd..fe9d2a08f2 100644
--- a/apis/ec2/src/main/java/org/jclouds/ec2/compute/strategy/EC2CreateNodesInGroupThenAddToSet.java
+++ b/apis/ec2/src/main/java/org/jclouds/ec2/compute/strategy/EC2CreateNodesInGroupThenAddToSet.java
@@ -58,6 +58,7 @@ import org.jclouds.logging.Logger;
 
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.base.Function;
+import com.google.common.base.Optional;
 import com.google.common.base.Predicate;
 import com.google.common.cache.LoadingCache;
 import com.google.common.collect.ImmutableMap;
@@ -95,7 +96,7 @@ public class EC2CreateNodesInGroupThenAddToSet implements CreateNodesInGroupThen
    @VisibleForTesting
    final ComputeUtils utils;
    final PresentInstances presentInstances;
-   final LoadingCache<RunningInstance, LoginCredentials> instanceToCredentials;
+   final LoadingCache<RunningInstance, Optional<LoginCredentials>> instanceToCredentials;
    final Map<String, Credentials> credentialStore;
 
    @Inject
@@ -105,7 +106,7 @@ public class EC2CreateNodesInGroupThenAddToSet implements CreateNodesInGroupThen
          @Named(TIMEOUT_NODE_RUNNING) Predicate<AtomicReference<NodeMetadata>> nodeRunning,
          CreateKeyPairAndSecurityGroupsAsNeededAndReturnRunOptions createKeyPairAndSecurityGroupsAsNeededAndReturncustomize,
          PresentInstances presentInstances, Function<RunningInstance, NodeMetadata> runningInstanceToNodeMetadata,
-         LoadingCache<RunningInstance, LoginCredentials> instanceToCredentials,
+         LoadingCache<RunningInstance, Optional<LoginCredentials>> instanceToCredentials,
          Map<String, Credentials> credentialStore, ComputeUtils utils) {
       this.client = checkNotNull(client, "client");
       this.elasticIpCache = checkNotNull(elasticIpCache, "elasticIpCache");
@@ -174,7 +175,7 @@ public class EC2CreateNodesInGroupThenAddToSet implements CreateNodesInGroupThen
    private void populateCredentials(Set<RunningInstance> input, TemplateOptions options) {
       LoginCredentials credentials = null;
       for (RunningInstance instance : input) {
-         credentials = instanceToCredentials.apply(instance);
+         credentials = instanceToCredentials.apply(instance).orNull();
          if (credentials != null)
             break;
       }
diff --git a/apis/ec2/src/test/java/org/jclouds/ec2/compute/strategy/EC2CreateNodesInGroupThenAddToSetTest.java b/apis/ec2/src/test/java/org/jclouds/ec2/compute/strategy/EC2CreateNodesInGroupThenAddToSetTest.java
index 23d21a670d..c4cb970da5 100644
--- a/apis/ec2/src/test/java/org/jclouds/ec2/compute/strategy/EC2CreateNodesInGroupThenAddToSetTest.java
+++ b/apis/ec2/src/test/java/org/jclouds/ec2/compute/strategy/EC2CreateNodesInGroupThenAddToSetTest.java
@@ -57,6 +57,7 @@ import org.jclouds.ec2.services.InstanceClient;
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
+import com.google.common.base.Optional;
 import com.google.common.cache.LoadingCache;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Iterables;
@@ -115,7 +116,7 @@ public class EC2CreateNodesInGroupThenAddToSetTest {
       expect(instance.getId()).andReturn(instanceCreatedId).atLeastOnce();
       // simulate a lazy credentials fetch
       LoginCredentials creds = LoginCredentials.builder().user("foo").privateKey("bar").build();
-      expect(strategy.instanceToCredentials.apply(instance)).andReturn(creds);
+      expect(strategy.instanceToCredentials.apply(instance)).andReturn(Optional.of(creds));
       expect(instance.getRegion()).andReturn(region).atLeastOnce();
       expect(strategy.credentialStore.put("node#" + region + "/" + instanceCreatedId, creds)).andReturn(null);
 
@@ -213,7 +214,7 @@ public class EC2CreateNodesInGroupThenAddToSetTest {
       expect(instance.getId()).andReturn(instanceCreatedId).atLeastOnce();
       // simulate a lazy credentials fetch
       LoginCredentials creds = LoginCredentials.builder().user("foo").privateKey("bar").build();
-      expect(strategy.instanceToCredentials.apply(instance)).andReturn(creds);
+      expect(strategy.instanceToCredentials.apply(instance)).andReturn(Optional.of(creds));
       expect(instance.getRegion()).andReturn(region).atLeastOnce();
       expect(strategy.credentialStore.put("node#" + region + "/" + instanceCreatedId, creds)).andReturn(null);
 
@@ -312,7 +313,7 @@ public class EC2CreateNodesInGroupThenAddToSetTest {
       CreateKeyPairAndSecurityGroupsAsNeededAndReturnRunOptions createKeyPairAndSecurityGroupsAsNeededAndReturncustomize = createMock(CreateKeyPairAndSecurityGroupsAsNeededAndReturnRunOptions.class);
       PresentInstances presentInstances = createMock(PresentInstances.class);
       RunningInstanceToNodeMetadata runningInstanceToNodeMetadata = createMock(RunningInstanceToNodeMetadata.class);
-      LoadingCache<RunningInstance, LoginCredentials> instanceToCredentials = createMock(LoadingCache.class);
+      LoadingCache<RunningInstance, Optional<LoginCredentials>> instanceToCredentials = createMock(LoadingCache.class);
       LoadingCache<RegionAndName, String> elasticIpCache = createMock(LoadingCache.class);
       GetNodeMetadataStrategy nodeRunning = new GetNodeMetadataStrategy(){
 
diff --git a/providers/aws-ec2/src/main/java/org/jclouds/aws/ec2/compute/config/AWSEC2ComputeServiceDependenciesModule.java b/providers/aws-ec2/src/main/java/org/jclouds/aws/ec2/compute/config/AWSEC2ComputeServiceDependenciesModule.java
index 5a46d6c571..8789b76317 100644
--- a/providers/aws-ec2/src/main/java/org/jclouds/aws/ec2/compute/config/AWSEC2ComputeServiceDependenciesModule.java
+++ b/providers/aws-ec2/src/main/java/org/jclouds/aws/ec2/compute/config/AWSEC2ComputeServiceDependenciesModule.java
@@ -66,6 +66,7 @@ import org.jclouds.predicates.PredicateWithResult;
 import org.jclouds.predicates.RetryablePredicate;
 
 import com.google.common.base.Function;
+import com.google.common.base.Optional;
 import com.google.common.base.Predicate;
 import com.google.common.base.Strings;
 import com.google.common.cache.CacheBuilder;
@@ -89,7 +90,7 @@ public class AWSEC2ComputeServiceDependenciesModule extends EC2ComputeServiceDep
       bind(TemplateBuilder.class).to(EC2TemplateBuilderImpl.class);
       bind(TemplateOptions.class).to(AWSEC2TemplateOptions.class);
       bind(ComputeService.class).to(AWSEC2ComputeService.class);
-      bind(new TypeLiteral<CacheLoader<RunningInstance, LoginCredentials>>() {
+      bind(new TypeLiteral<CacheLoader<RunningInstance, Optional<LoginCredentials>>>() {
       }).to(CredentialsForInstance.class);
       bind(new TypeLiteral<CacheLoader<RegionAndName, String>>() {
       }).annotatedWith(Names.named("SECURITY")).to(CreateSecurityGroupIfNeeded.class);
diff --git a/providers/aws-ec2/src/main/java/org/jclouds/aws/ec2/compute/strategy/AWSEC2CreateNodesInGroupThenAddToSet.java b/providers/aws-ec2/src/main/java/org/jclouds/aws/ec2/compute/strategy/AWSEC2CreateNodesInGroupThenAddToSet.java
index ea08151396..05a86355d6 100644
--- a/providers/aws-ec2/src/main/java/org/jclouds/aws/ec2/compute/strategy/AWSEC2CreateNodesInGroupThenAddToSet.java
+++ b/providers/aws-ec2/src/main/java/org/jclouds/aws/ec2/compute/strategy/AWSEC2CreateNodesInGroupThenAddToSet.java
@@ -53,6 +53,7 @@ import org.jclouds.logging.Logger;
 
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.base.Function;
+import com.google.common.base.Optional;
 import com.google.common.base.Predicate;
 import com.google.common.cache.LoadingCache;
 import com.google.common.collect.ImmutableSet;
@@ -81,7 +82,7 @@ public class AWSEC2CreateNodesInGroupThenAddToSet extends EC2CreateNodesInGroupT
          CreateKeyPairPlacementAndSecurityGroupsAsNeededAndReturnRunOptions createKeyPairAndSecurityGroupsAsNeededAndReturncustomize,
          PresentSpotRequestsAndInstances instancePresent,
          Function<RunningInstance, NodeMetadata> runningInstanceToNodeMetadata,
-         LoadingCache<RunningInstance, LoginCredentials> instanceToCredentials,
+         LoadingCache<RunningInstance, Optional<LoginCredentials>> instanceToCredentials,
          Map<String, Credentials> credentialStore, ComputeUtils utils,
          SpotInstanceRequestToAWSRunningInstance spotConverter) {
       super(client, elasticIpCache, nodeRunning, createKeyPairAndSecurityGroupsAsNeededAndReturncustomize,