allow ec2-user (if present)