We don’t really have any “best practices” to recommend at this point. We’re all kind of learning as we go here. 
For the instances themselves, they need Deadline installed and licensed, and all applications you plan to use for rendering need to be installed and licensed (just like a typical render node).
The tricky part is figuring out how to deal with your assets and your rendered images, and this will all depend on your pipeline. For example, you’ll need to get your assets (textures, caches, etc) uploaded to the cloud somehow. This could be a manual process, or a sync folder, but either way, your instances will have to be able to find them. This could mean making sure your asset paths on your local network are identical on the cloud.
When it comes to rendered images, you probably don’t want to be downloading everything that gets rendered to save on transfer costs. If you are rendering out large EXRs, you might want to convert them to JPEGs first for review, and only download the EXRs if you’re happy with the results. If you’re creating large sim caches in the cloud, you might just want to keep them there for the render that uses them, rather than transferring all that cached data back to the local network.
When it comes to where to put the Repository, that also depends on your pipeline. Do you still plan on having local render nodes connect? If so, are you wanting one repository to share between your local nodes and your EC2 instances, or do you want separate repositories? If you want to share, then you’ll want to put the repo wherever it works best. If you want separate repositories, you could use the job right-click script in the Monitor to transfer jobs from the local to the cloud repo.
For secure transfers, AWS sounds like it might do the trick. We don’t have experience with it ourselves though.
aws.amazon.com/directconnect/
So, yeah, not a lot of concrete answers there, but it’s one of those questions that doesn’t really have one “right” answer at this point.
Cheers,