Use VPC and IAM roles; update AMI to HVM so it can run in VPC.