added userdata, tweaked ACLs ... still need to add a NAT instance at web tier to allow for patching/installation of packages