EC2 `UserData` выполнение зависает на` Проверка сценариев инициализации ... `

Question

У меня есть сценарий YAML Cloudformation, который запускает один экземпляр EC2 и при запуске запускает UserData.

Я использую ami-0727f3c2d4b0226d5, стандартный сервер Ubuntu 18:04 LTS.

Все работает нормально, если UserData прост, например, -

UserData:
  Fn::Base64:
    !Sub |
      #!/bin/bash -ex
      echo "Hello World EC2!"

, что дает мне следующее в системном журнале EC2 -

[[0;32m  OK  [0m] Started Apply the settings specified in cloud-config.
         Starting Execute cloud user/final scripts...
[   21.827930] cloud-init[1307]: + echo 'Hello World EC2!'
[   21.832906] cloud-init[1307]: Hello World EC2!

, но если я расширяю UserData для некоторых довольно нормально выглядящих команд Ubuntu -

UserData:
  Fn::Base64:
    !Sub |
      #!/bin/bash -ex
      apt-get update
      apt-get install -y ruby
      echo "Hello World EC2!"

затем (сорвав исходный компьютер и перезапустив новый экземпляр с нуля), процесс UserData кажется зависшим со следующими сообщениями всистемный журнал -

[   29.606055] cloud-init[1304]: + apt-get install -y ruby
[   29.675005] cloud-init[1304]: Reading package lists...
[   29.828430] cloud-init[1304]: Building dependency tree...
[   29.836236] cloud-init[1304]: Reading state information...
[   ...   ]
[   ...   ]
[   ...   ]
[   34.233706] cloud-init[1304]: Checking for services that may need to be restarted...done.
[   34.254767] cloud-init[1304]: Checking for services that may need to be restarted...done.
[   34.262182] cloud-init[1304]: Checking init scripts...

т.е. Checking init scripts ... никогда не возвращается. Любые мысли о том, как отладить эту ситуацию / выяснить, что идет не так?

TIA

---

[полный YAML CF включен]

---
AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  AppName:
    Type: String
  InstanceType:
    Type: String
    Default: t2.micro
  ImageId:
    Type: String
    Default: ami-0727f3c2d4b0226d5  # 18.04 LTS eu-west-1
  KeyName:
    Type: String
Outputs:
  MyDNSName:
    Value:
      Fn::GetAtt:
        - AppEC2Instance
        - PublicDnsName
    Description: "EC2 public DNS name"
  MyIPAddress:
    Value:
      Fn::GetAtt:
        - AppEC2Instance
        - PublicIp
    Description: "EC2 public IP address"
  MyInstanceId:
    Value:
      Ref: AppEC2Instance
    Description: "EC2 instance id"
Resources:
  AppEC2Instance:
    Properties:
      IamInstanceProfile:
        Ref: AppInstanceProfile
      ImageId:
        Ref: ImageId
      InstanceType:
        Ref: InstanceType
      KeyName:
        Ref: KeyName
      SecurityGroupIds:
        - Fn::GetAtt:
            - AppSecurityGroup
            - GroupId
      SubnetId:
        Ref: AppSubnet
      Tags:
        - Key: Name
          Value:
            Ref: AppName
      UserData:
        Fn::Base64:
          !Sub |
            #!/bin/bash -ex
            apt-get update
            apt-get install -y ruby
            echo "Hello World EC2!"    
    Type: AWS::EC2::Instance
  AppInstanceProfile:
    Properties:
      Path: /
      Roles:
        - Ref: AppInstanceRole
    Type: AWS::IAM::InstanceProfile
  AppInstanceRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
        Version: '2012-10-17'
      Path: /
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - ec2:DescribeTags  # allow codedeploy to find machine
                Effect: Allow
                Resource: '*'
              - Action: s3:*  # allow machine to access deployables
                Effect: Allow
                Resource: '*'
              - Action: logs:*
                Effect: Allow
                Resource: '*'
            Version: '2012-10-17'
          PolicyName:  # required
            Fn::Join:
              - '-'
              - - Ref: AppName
                - ec2
    Type: AWS::IAM::Role
  AppSecurityGroup:
    Properties:
      GroupDescription:
        Ref: AppName
      SecurityGroupIngress:
        - CidrIp: 0.0.0.0/0
          FromPort: '3000'
          IpProtocol: tcp
          ToPort: '3000'
      VpcId:
        Ref: AppVPC
    Type: AWS::EC2::SecurityGroup
  AppInternetGateway:
    Type: AWS::EC2::InternetGateway
  AppRoute:
    DependsOn: AppInternetGateway
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId:
        Ref: AppInternetGateway
      RouteTableId:
        Ref: AppRouteTable
    Type: AWS::EC2::Route
  AppRouteTable:
    Properties:
      VpcId:
        Ref: AppVPC
    Type: AWS::EC2::RouteTable
  AppSubnet:
    Properties:
      CidrBlock: 172.31.0.0/20
      MapPublicIpOnLaunch: true
      VpcId:
        Ref: AppVPC
    Type: AWS::EC2::Subnet
  AppSubnetRouteTableAssociation:
    Properties:
      RouteTableId:
        Ref: AppRouteTable
      SubnetId:
        Ref: AppSubnet
    Type: AWS::EC2::SubnetRouteTableAssociation
  AppVPC:
    Properties:
      CidrBlock: 172.31.0.0/16
      EnableDnsHostnames: true
      EnableDnsSupport: true
      InstanceTenancy: default
    Type: AWS::EC2::VPC
  AppVPCGatewayAttachment:
    Properties:
      InternetGatewayId:
        Ref: AppInternetGateway
      VpcId:
        Ref: AppVPC
    Type: AWS::EC2::VPCGatewayAttachment
  AppCodeDeployApp:
    Properties:
      ApplicationName:
        Ref: AppName
    Type: AWS::CodeDeploy::Application
  AppCodeDeployGroup:
    Properties:
      ApplicationName:
        Ref: AppCodeDeployApp
      DeploymentConfigName: CodeDeployDefault.AllAtOnce
      DeploymentGroupName:
        Ref: AppName
      Ec2TagFilters:  # lookup ec2 machine for deployment
        - Key: Name
          Type: KEY_AND_VALUE
          Value:
            Ref: AppName
      ServiceRoleArn:
        Fn::GetAtt:
          - AppCodeDeployRole
          - Arn
    Type: AWS::CodeDeploy::DeploymentGroup
  AppCodeDeployRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - codedeploy.amazonaws.com
        Version: '2012-10-17'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSCodeDeployRole
      Path: /
    Type: AWS::IAM::Role