IAM Role.

IAM Instance Profile.

This section is purposely left in, but commented out as we do not know exactly what would be needed for a real DW server in AWS. We might need to use this section to install or configure things so leaving it so we don't have to start from scratch.
UserData: Fn::Base64: !Sub |

  # >> Add function to memory.
  Function Set-SystemForNextRun {
      Param (
          [string]$CodeSectionComplete,
          [switch]$UserDataReset,
          [switch]$RestartInstance
      )
      If ($CodeSectionComplete) {
          [System.Void](New-ItemProperty -Path 'HKLM:\SOFTWARE\Docuware' -Name "CodeSection$CodeSectionComplete" -Value 'Complete')
      } # End If.
      If ($UserDataReset) {
          try {
              $Path = 'C:\Program Files\Amazon\Ec2ConfigService\Settings\config.xml'
              [xml]$ConfigXml = Get-Content -Path $Path -ErrorAction Stop
              ($ConfigXml.Ec2ConfigurationSettings.Plugins.Plugin |
                  Where-Object -Property Name -eq 'Ec2HandleUserData').State = 'Enabled'
              $ConfigXml.Save($Path)
          } catch {
              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File C:\ProgramData\Amazon\EC2-Windows\Launch\Scripts\InitializeInstance.ps1 -Schedule
          } # End try-catch.
      } # End If.
      If ($RestartInstance) {
          Restart-Computer -Force
      } # End If.
  } # End Function: Set-SystemForNextRun.

  # >> Check for/Create Windows Registry Key.
  If (-Not(Get-Item -Path 'HKLM:\SOFTWARE\Docuware' -ErrorAction SilentlyContinue)) {
      [System.Void](New-Item -Path 'HKLM:\SOFTWARE\' -Name 'Docuware')
  } # End If.

  # >> Run user code/invoke Set-SystemForNextRun function.
  If (-Not((Get-ItemProperty -Path 'HKLM:\SOFTWARE\Docuware').CodeSection1 -eq 'Complete')) {

      # Set TimeZone.
      tzutil.exe /s 'US Mountain Standard Time'
      Start-Sleep -Seconds 10

      # Copy installer from S3 to Public Desktop.
      $Az = Invoke-RestMethod -Uri 'http://169.254.169.254/latest/meta-data/placement/availability-zone'
      $Region = $Az -replace ".$"

      $Params = @{
          BucketName = 'erp-ni-labview-prod'
          Key = 'NI_Volume_License_Manager_3.1.1.zip'
          File = "$($env:PUBLIC)\Desktop\NI_Volume_License_Manager_3.1.1.zip"
          Region = $Region
      }
      Read-S3Object @Params | Out-Null
      Start-Sleep -Seconds 10

      # Rename Computer.
      $WarningPreference =  'SilentlyContinue'
      Rename-Computer -NewName 'Docuware' -Force
      $WarningPreference = 'Continue'
      Start-Sleep -Seconds 10

      Set-SystemForNextRun -CodeSectionComplete 1 -Restart
  } # End If.
  </powershell>

TODO - This needs to change and probably be a generic SG that allows access from within the VPC