the field NON_ADDABLE_USERS is now poorly named as we don't treat them separately when deciding what user to add.  the loginUser and dontCreateUser fields are a much cleaner way to distinguish roles.  and you make a good point in the test comment that if you're ec2-user@aws-machine trying to run against non-aws, the old behaviour is bad!

suggest changing it to COMMON_USER_NAMES_TO_TRY or similar.  also might want to add "admin" to the list now.