cloud-mu 3.1.3 → 3.3.0

data/modules/mu/{clouds → providers}/aws/search_domain.rb

@@ -22,9 +22,9 @@ module MU
         # @param args [Hash]: Hash of named arguments passed via Ruby's double-splat
         def initialize(**args)
           super
-          if @cloud_id and !@config['domain_name']
-            @config['domain_name'] = @cloud_id
-          end
+          describe if @mu_name and !@deploydata
+          @cloud_id ||= @deploydata['domain_name'] if @deploydata
+
           @mu_name ||= @deploy.getResourceName(@config["name"])
         end
 
@@ -35,7 +35,8 @@ module MU
           params = genParams
 
           MU.log "Creating ElasticSearch domain #{@config['domain_name']}", details: params
-          resp = MU::Cloud::AWS.elasticsearch(region: @config['region'], credentials: @config['credentials']).create_elasticsearch_domain(params).domain_status
+          @cloud_id = @config['domain_name']
+          MU::Cloud::AWS.elasticsearch(region: @config['region'], credentials: @credentials).create_elasticsearch_domain(params).domain_status
 
           tagDomain
 
@@ -44,47 +45,50 @@ module MU
         # Called automatically by {MU::Deploy#createResources}
         def groom
           tagDomain
-          @config['domain_name'] ||= @deploydata['domain_name']
+          @config['domain_name'] ||= @cloud_id
           params = genParams(cloud_desc) # get parameters that would change only
 
           if params.size > 1
             waitWhileProcessing # wait until the create finishes, if still going
 
             MU.log "Updating ElasticSearch domain #{@config['domain_name']}", MU::NOTICE, details: params
-            MU::Cloud::AWS.elasticsearch(region: @config['region'], credentials: @config['credentials']).update_elasticsearch_domain_config(params)
+            MU::Cloud::AWS.elasticsearch(region: @config['region'], credentials: @credentials).update_elasticsearch_domain_config(params)
           end
 
           waitWhileProcessing # don't return until creation/updating is complete
+          MU.log "Search Domain #{@config['name']}: #{cloud_desc.endpoint}", MU::SUMMARY
         end
 
+        @cloud_desc_cache = nil
         # Wrapper for cloud_desc method that deals with finding the AWS
         # domain_name parameter, which isn't what we'd call ourselves if we had
         # our druthers.
-        def cloud_desc
-          if @config['domain_name']
-            MU::Cloud::AWS.elasticsearch(region: @config['region'], credentials: @config['credentials']).describe_elasticsearch_domain(
-              domain_name: @config['domain_name']
+        def cloud_desc(use_cache: true)
+          return @cloud_desc_cache if @cloud_desc_cache and use_cache
+          @cloud_id ||= @config['domain_name']
+          return nil if !@cloud_id
+          MU.retrier([::Aws::ElasticsearchService::Errors::ResourceNotFoundException], wait: 10, max: 12) {
+            @cloud_desc_cache = MU::Cloud::AWS.elasticsearch(region: @config['region'], credentials: @credentials).describe_elasticsearch_domain(
+              domain_name: @cloud_id
             ).domain_status
-          elsif @deploydata and @deploydata['domain_name']
-            MU::Cloud::AWS.elasticsearch(region: @config['region'], credentials: @config['credentials']).describe_elasticsearch_domain(
-              domain_name: @deploydata['domain_name']
-            ).domain_status
-          else
-            raise MuError, "#{@mu_name} can't find its official Elasticsearch domain name!"
-          end
+          }
+
+          @cloud_desc_cache
         end
 
         # Canonical Amazon Resource Number for this resource
         # @return [String]
         def arn
-          cloud_desc.arn
+          return nil if !cloud_desc
+          cloud_desc.arn.dup
         end
 
         # Return the metadata for this SearchDomain rule
         # @return [Hash]
         def notify
-          deploy_struct = MU.structToHash(cloud_desc)
-          tags = MU::Cloud::AWS.elasticsearch(region: @config['region'], credentials: @config['credentials']).list_tags(arn: deploy_struct[:arn]).tag_list
+          return nil if !cloud_desc(use_cache: false)
+          deploy_struct = MU.structToHash(cloud_desc, stringify_keys: true)
+          tags = MU::Cloud::AWS.elasticsearch(region: @config['region'], credentials: @credentials).list_tags(arn: arn).tag_list
           deploy_struct['tags'] = tags.map { |t| { t.key => t.value } }
           if deploy_struct['endpoint']
             deploy_struct['kibana'] = deploy_struct['endpoint']+"/_plugin/kibana/"
@@ -116,26 +120,34 @@ module MU
         # @param ignoremaster [Boolean]: If true, will remove resources not flagged as originating from this Mu server
         # @param region [String]: The cloud provider region
         # @return [void]
-        def self.cleanup(noop: false, ignoremaster: false, region: MU.curRegion, credentials: nil, flags: {})
-          list = MU::Cloud::AWS.elasticsearch(region: region).list_domain_names
+        def self.cleanup(noop: false, deploy_id: MU.deploy_id, ignoremaster: false, region: MU.curRegion, credentials: nil, flags: {})
+          MU.log "AWS::SearchDomain.cleanup: need to support flags['known']", MU::DEBUG, details: flags
+
+          list = MU::Cloud::AWS.elasticsearch(region: region, credentials: credentials).list_domain_names
           if list and list.domain_names and list.domain_names.size > 0
             names = list.domain_names.map { |d| d.domain_name }
             begin
               # why is this API so obnoxious?
               sample = names.slice!(0, (names.length >= 5 ? 5 : names.length))
-              descs = MU::Cloud::AWS.elasticsearch(region: region).describe_elasticsearch_domains(domain_names: sample)
+              descs = MU::Cloud::AWS.elasticsearch(region: region, credentials: credentials).describe_elasticsearch_domains(domain_names: sample)
 
               descs.domain_status_list.each { |domain|
-                tags = MU::Cloud::AWS.elasticsearch(region: region).list_tags(arn: domain.arn)
+                tags = MU::Cloud::AWS.elasticsearch(region: region, credentials: credentials).list_tags(arn: domain.arn)
+                deploy_match = false
+                master_match = false
                 tags.tag_list.each { |tag|
-                  if tag.key == "MU-ID" and tag.value == MU.deploy_id
-                    MU.log "Deleting ElasticSearch Domain #{domain.domain_name}"
-                    if !noop
-                      MU::Cloud::AWS.elasticsearch(region: region).delete_elasticsearch_domain(domain_name: domain.domain_name)
-                    end
-                    break
+                  if tag.key == "MU-ID" and tag.value == deploy_id
+                    deploy_match = true
+                  elsif tag.key == "MU-MASTER-IP" and tag.value == MU.mu_public_ip
+                    master_match = true
                   end
                 }
+                if deploy_match and (master_match or ignoremaster)
+                  MU.log "Deleting ElasticSearch Domain #{domain.domain_name}"
+                  if !noop
+                    MU::Cloud::AWS.elasticsearch(region: region, credentials: credentials).delete_elasticsearch_domain(domain_name: domain.domain_name)
+                  end
+                end
               }
             end while names.size > 0
           end
@@ -143,10 +155,10 @@ module MU
           unless noop
             marker = nil
             begin
-              resp = MU::Cloud::AWS.iam.list_roles(marker: marker)
+              resp = MU::Cloud::AWS.iam(credentials: credentials).list_roles(marker: marker)
               resp.roles.each{ |role|
-                # XXX Maybe we should have a more generic way to delete IAM profiles and policies. The call itself should be moved from MU::Cloud::AWS::Server.
-#                MU::Cloud::AWS::Server.removeIAMProfile(role.role_name) if role.role_name.match(/^#{Regexp.quote(MU.deploy_id)}/)
+                # XXX Maybe we should have a more generic way to delete IAM profiles and policies. The call itself should be moved from MU::Cloud.resourceClass("AWS", "Server").
+#                MU::Cloud.resourceClass("AWS", "Server").removeIAMProfile(role.role_name) if role.role_name.match(/^#{Regexp.quote(deploy_id)}/)
               }
               marker = resp.marker
             end while resp.is_truncated
@@ -180,16 +192,106 @@ module MU
           found
         end
 
+        # Reverse-map our cloud description into a runnable config hash.
+        # We assume that any values we have in +@config+ are placeholders, and
+        # calculate our own accordingly based on what's live in the cloud.
+        def toKitten(**_args)
+          bok = {
+            "cloud" => "AWS",
+            "credentials" => @credentials,
+            "cloud_id" => @cloud_id,
+            "region" => @config['region']
+          }
+
+          if !cloud_desc
+            MU.log "toKitten failed to load a cloud_desc from #{@cloud_id}", MU::ERR, details: @config
+            return nil
+          end
+
+          bok['name'] = cloud_desc.domain_name
+          bok['elasticsearch_version'] = cloud_desc.elasticsearch_version
+          bok['instance_count'] = cloud_desc.elasticsearch_cluster_config.instance_count
+          bok['instance_type'] = cloud_desc.elasticsearch_cluster_config.instance_type
+          bok['zone_aware'] = cloud_desc.elasticsearch_cluster_config.zone_awareness_enabled
+
+          if cloud_desc.elasticsearch_cluster_config.dedicated_master_enabled
+            bok['dedicated_masters'] = cloud_desc.elasticsearch_cluster_config.dedicated_master_count
+            bok['master_instance_type'] = cloud_desc.elasticsearch_cluster_config.dedicated_master_type
+          end
+
+          if cloud_desc.access_policies and !cloud_desc.access_policies.empty?
+            bok['access_policies'] = JSON.parse(cloud_desc.access_policies)
+          end
+
+          if cloud_desc.advanced_options and !cloud_desc.advanced_options.empty?
+            bok['advanced_options'] = cloud_desc.advanced_options
+          end
+
+          bok['ebs_size'] = cloud_desc.ebs_options.volume_size
+          bok['ebs_type'] = cloud_desc.ebs_options.volume_type
+          bok['ebs_iops'] = cloud_desc.ebs_options.iops if cloud_desc.ebs_options.iops
+
+          if cloud_desc.snapshot_options and cloud_desc.snapshot_options.automated_snapshot_start_hour
+            bok['snapshot_hour'] = cloud_desc.snapshot_options.automated_snapshot_start_hour
+          end
+
+          if cloud_desc.cognito_options.user_pool_id and
+             cloud_desc.cognito_options.identity_pool_id
+            bok['user_pool_id'] = cloud_desc.cognito_options.user_pool_id
+            bok['identity_pool_id'] = cloud_desc.cognito_options.identity_pool_id
+          end
+
+          tags = MU::Cloud::AWS.elasticsearch(region: @config['region'], credentials: @credentials).list_tags(arn: cloud_desc.arn).tag_list
+          if tags and !tags.empty?
+            bok['tags'] = MU.structToHash(tags)
+          end
+
+          if cloud_desc.vpc_options
+            bok['vpc'] = MU::Config::Ref.get(
+              id: cloud_desc.vpc_options.vpc_id,
+              cloud: "AWS",
+              credentials: @credentials,
+              type: "vpcs",
+              region: @config['region'],
+              subnets: cloud_desc.vpc_options.subnet_ids.map { |s| { "subnet_id" => s } }
+            )
+            if cloud_desc.vpc_options.security_group_ids and
+               !cloud_desc.vpc_options.security_group_ids.empty?
+              bok['add_firewall_rules'] = cloud_desc.vpc_options.security_group_ids.map { |sg|
+                MU::Config::Ref.get(
+                  id: sg,
+                  cloud: "AWS",
+                  credentials: @credentials,
+                  region: @config['region'],
+                  type: "firewall_rules",
+                )
+              }
+            end
+          end
+
+          if cloud_desc.log_publishing_options
+            # XXX this is primitive... there are multiple other log types now,
+            # and this should be a Ref blob, not a flat string
+            cloud_desc.log_publishing_options.each_pair { |type, whither|
+              if type == "SEARCH_SLOW_LOGS"
+                bok['slow_logs'] = whither.cloud_watch_logs_log_group_arn
+              end
+            }
+          end
+
+          bok
+        end
+
         # Cloud-specific configuration properties.
-        # @param config [MU::Config]: The calling MU::Config object
+        # @param _config [MU::Config]: The calling MU::Config object
         # @return [Array<Array,Hash>]: List of required fields, and json-schema Hash of cloud-specific configuration parameters for this resource
-        def self.schema(config)
+        def self.schema(_config)
           toplevel_required = ["elasticsearch_version", "instance_type"]
 
           versions = begin
             MU::Cloud::AWS.elasticsearch.list_elasticsearch_versions.elasticsearch_versions
-          rescue MuError => e
-            ["7.1", "6.8", "6.7", "6.5", "6.4", "6.3", "6.2", "6.0", "5.6"]
+          rescue MuError
+            ["7.4", "7.1", "6.8", "6.7", "6.5", "6.4", "6.3", "6.2", "6.0", "5.6"]
           end
           instance_types = begin
             MU::Cloud::AWS.elasticsearch.list_elasticsearch_instance_types(
@@ -204,6 +306,8 @@ module MU
             ).elasticsearch_instance_types
           end
 
+          polschema = MU::Config::Role.schema["properties"]["policies"]
+          polschema.deep_merge!(MU::Cloud.resourceClass("AWS", "Role").condition_schema)
 
           schema = {
             "name" => {
@@ -225,9 +329,10 @@ module MU
               "default" => 0,
               "description" => "Separate, dedicated master node(s), over and above the search instances specified in instance_count."
             },
+            "policies" => polschema,
             "access_policies" => {
               "type" => "object",
-              "description" => "An IAM policy document for access to ElasticSearch. Our parser expects this to be defined inline like the rest of your YAML/JSON Basket of Kittens, not as raw JSON. For guidance on ElasticSearch IAM capabilities, see: https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-ac.html"
+              "description" => "An IAM policy document for access to ElasticSearch (see {policies} for setting complex access policies with runtime dependencies). Our parser expects this to be defined inline like the rest of your YAML/JSON Basket of Kittens, not as raw JSON. For guidance on ElasticSearch IAM capabilities, see: https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-ac.html"
             },
             "master_instance_type" => {
               "type" => "string",
@@ -235,7 +340,7 @@ module MU
             },
             "ebs_type" => {
               "type" => "string",
-              "default" => "standard",
+              "default" => "gp2",
               "description" => "Type of EBS storage to use for cluster nodes. If 'none' is specified, EBS storage will not be used, but this is only valid for certain instance types.",
               "enum" => ["standard", "gp2", "io1", "none"]
             },
@@ -367,9 +472,9 @@ module MU
 
           if dom['slow_logs']
             if configurator.haveLitterMate?(dom['slow_logs'], "log")
-              dom['dependencies'] << { "name" => dom['slow_logs'], "type" => "log" }
+              MU::Config.addDependency(dom, dom['slow_logs'], "log")
             else
-              log_group = MU::Cloud::AWS::Log.find(cloud_id: dom['slow_logs'], region: dom['region']).values.first
+              log_group = MU::Cloud.resourceClass("AWS", "Log").find(cloud_id: dom['slow_logs'], region: dom['region']).values.first
               if !log_group
                 MU.log "Specified slow_logs CloudWatch log group '#{dom['slow_logs']}' in SearchDomain '#{dom['name']}' doesn't appear to exist", MU::ERR
                 ok = false
@@ -384,7 +489,7 @@ module MU
               "credentials" => dom['credentials']
             }
             ok = false if !configurator.insertKitten(log_group, "logs")
-            dom['dependencies'] << { "name" => dom['slow_logs'], "type" => "log" }
+            MU::Config.addDependency(dom, dom['slow_logs'], "log")
           end
 
           if dom['advanced_options']
@@ -398,7 +503,7 @@ module MU
               MU::Cloud::AWS.cognito_ident(region: dom['region']).describe_identity_pool(
                 identity_pool_id: dom['cognito']['identity_pool_id']
               )
-            rescue ::Aws::CognitoIdentity::Errors::ValidationException, Aws::CognitoIdentity::Errors::ResourceNotFoundException => e
+            rescue ::Aws::CognitoIdentity::Errors::ValidationException, Aws::CognitoIdentity::Errors::ResourceNotFoundException
               MU.log "Cognito identity pool #{dom['cognito']['identity_pool_id']} malformed or does not exist in SearchDomain '#{dom['name']}'", MU::ERR
               ok = false
             end
@@ -406,7 +511,7 @@ module MU
               MU::Cloud::AWS.cognito_user(region: dom['region']).describe_user_pool(
                 user_pool_id: dom['cognito']['user_pool_id']
               )
-            rescue ::Aws::CognitoIdentityProvider::Errors::InvalidParameterException, Aws::CognitoIdentityProvider::Errors::ResourceNotFoundException => e
+            rescue ::Aws::CognitoIdentityProvider::Errors::InvalidParameterException, Aws::CognitoIdentityProvider::Errors::ResourceNotFoundException
               MU.log "Cognito identity pool #{dom['cognito']['user_pool_id']} malformed or does not exist in SearchDomain '#{dom['name']}'", MU::ERR
               ok = false
             end
@@ -426,7 +531,7 @@ module MU
                 if !found
                   MU.log "IAM role #{dom['cognito']['role_arn']} exists, but not does have the AmazonESCognitoAccess policy attached. SearchDomain '#{dom['name']}' may not have necessary Cognito permissions.", MU::WARN
                 end
-              rescue Aws::IAM::Errors::NoSuchEntity => e
+              rescue Aws::IAM::Errors::NoSuchEntity
                 MU.log "IAM role #{dom['cognito']['role_arn']} malformed or does not exist in SearchDomain '#{dom['name']}'", MU::ERR
                 ok = false
               end
@@ -445,12 +550,7 @@ module MU
                 ]
               }
               configurator.insertKitten(roledesc, "roles")
-
-              dom['dependencies'] ||= []
-              dom['dependencies'] << {
-                "type" => "role",
-                "name" => dom['name']+"cognitorole"
-              }
+              MU::Config.addDependency(dom, dom['name']+"cognitorole", "role")
             end
 
           end
@@ -503,9 +603,51 @@ module MU
             params[:snapshot_options][:automated_snapshot_start_hour] = @config['snapshot_hour']
           end
 
-          if @config['access_policies']
-            # TODO check against ext.access_policies.options
-            params[:access_policies] = JSON.generate(@config['access_policies'])
+          if ext
+            # Despite being called access_policies, this parameter actually
+            # only accepts one policy. So, we'll munge everything we have
+            # together into one policy with multiple Statements.
+            policy = nil
+            # TODO check against ext.access_policy.options
+
+            if @config['access_policies']
+              policy = @config['access_policies']
+              # ensure the "Statement" key is cased in a predictable way
+              statement_key = nil
+              policy.each_pair { |k, v|
+                if k.downcase == "statement" and k != "Statement"
+                  statement_key = k
+                  break
+                end
+              }
+              if statement_key
+                policy["Statement"] = policy.delete(statement_key)
+              end
+              if !policy["Statement"].is_a?(Array)
+                policy["Statement"] = [policy["Statement"]]
+              end
+            end
+
+            if @config['policies']
+              @config['policies'].each { |p|
+                p['targets'].each { |t|
+                  if t['path']
+                    t['path'].gsub!(/#SELF/, @mu_name.downcase)
+                  end
+                }
+                parsed = MU::Cloud.resourceClass("AWS", "Role").genPolicyDocument([p], deploy_obj: @deploy, bucket_style: true).first.values.first
+
+                if policy and policy["Statement"]
+                  policy["Statement"].concat(parsed["Statement"])
+                else
+                  policy = parsed
+                end
+              }
+            end
+
+            if policy
+              params[:access_policies] = JSON.generate(policy)
+            end
           end
 
           if @config['slow_logs']
@@ -514,7 +656,7 @@ module MU
               arn = @config['slow_logs']
             else
               log_group = @deploy.findLitterMate(type: "log", name: @config['slow_logs'])
-              log_group = MU::Cloud::AWS::Log.find(cloud_id: log_group.mu_name, region: log_group.cloudobj.config['region']).values.first
+              log_group = MU::Cloud.resourceClass("AWS", "Log").find(cloud_id: log_group.mu_name, region: log_group.cloudobj.config['region']).values.first
               if log_group.nil? or log_group.arn.nil?
                 raise MuError, "Failed to retrieve ARN of sibling LogGroup '#{@config['slow_logs']}'"
               end
@@ -541,7 +683,7 @@ module MU
               params[:log_publishing_options]["SEARCH_SLOW_LOGS"] = {}
               params[:log_publishing_options]["SEARCH_SLOW_LOGS"][:enabled] = true
               params[:log_publishing_options]["SEARCH_SLOW_LOGS"][:cloud_watch_logs_log_group_arn] = arn
-              MU::Cloud::AWS::Log.allowService("es.amazonaws.com", arn, @config['region'])
+              MU::Cloud.resourceClass("AWS", "Log").allowService("es.amazonaws.com", arn, @config['region'])
             end
           end
 
@@ -626,7 +768,7 @@ module MU
           # modify an existing group. AWS bug, workaround is to just apply
           # this in groom phase exclusively.
           if @config['cognito'] and !ext.nil?
-            myrole = setIAMPolicies
+            setIAMPolicies
 
             if ext.nil? or !ext.cognito_options.enabled or
                ext.cognito_options.user_pool_id != @config['cognito']['user_pool_id'] or
@@ -671,7 +813,7 @@ module MU
             raise MU::MuError, "Can't tag ElasticSearch domain, cloud descriptor came back without an ARN"
           end
 
-          MU::Cloud::AWS.elasticsearch(region: @config['region'], credentials: @config['credentials']).add_tags(
+          MU::Cloud::AWS.elasticsearch(region: @config['region'], credentials: @credentials).add_tags(
             arn: domain.arn,
             tag_list: tags
           )
@@ -682,7 +824,7 @@ module MU
           interval = 60
 
           begin
-            resp = cloud_desc
+            resp = cloud_desc(use_cache: false)
 
             if (resp.endpoint.nil? or resp.endpoint.empty?) and
                (resp.endpoints.nil? or resp.endpoints.empty?) and

data/modules/mu/{clouds → providers}/aws/server.rb

@@ -89,7 +89,7 @@ module MU
               template_variables: {
                 "deployKey" => Base64.urlsafe_encode64(@deploy.public_key),
                 "deploySSHKey" => @deploy.ssh_public_key,
-                "muID" => MU.deploy_id,
+                "muID" => @deploy.deploy_id,
                 "muUser" => MU.mu_user,
                 "publicIP" => MU.mu_public_ip,
                 "mommaCatPort" => MU.mommaCatPort,
@@ -145,7 +145,7 @@ module MU
               raise MuError, "My second argument should be a hash of variables to pass into ERB templates"
             end
             $mu = OpenStruct.new(template_variables)
-            userdata_dir = File.expand_path(MU.myRoot+"/modules/mu/clouds/aws/userdata")
+            userdata_dir = File.expand_path(MU.myRoot+"/modules/mu/providers/aws/userdata")
             platform = "linux" if %w{centos centos6 centos7 ubuntu ubuntu14 rhel rhel7 rhel71 amazon}.include? platform
             platform = "windows" if %w{win2k12r2 win2k12 win2k8 win2k8r2 win2k16}.include? platform
             erbfile = "#{userdata_dir}/#{platform}.erb"
@@ -212,7 +212,7 @@ module MU
               vol_id = attachment.volume_id
               vol_dev = attachment.device
               if vol_parent == instance_id and (vol_dev == device or device.nil?)
-                MU::MommaCat.createTag(vol_id, tag_name, tag_value, region: region, credentials: credentials)
+                MU::Cloud::AWS.createTag(vol_id, tag_name, tag_value, region: region, credentials: credentials)
                 break
               end
             }
@@ -240,11 +240,17 @@ module MU
             end
             MU::MommaCat.unlock(instance.instance_id+"-create")
           else
-            MU::Cloud::AWS.createStandardTags(instance.instance_id, region: @config['region'], credentials: @config['credentials'])
-            MU::MommaCat.createTag(instance.instance_id, "Name", @mu_name, region: @config['region'], credentials: @config['credentials'])
+            MU::Cloud::AWS.createStandardTags(
+              instance.instance_id,
+              region: @config['region'],
+              credentials: @config['credentials'],
+              optional: @config['optional_tags'],
+              nametag: @mu_name,
+              othertags: @config['tags']
+            )
           end
           done = true
-        rescue Exception => e
+        rescue StandardError => e
           if !instance.nil? and !done
             MU.log "Aborted before I could finish setting up #{@config['name']}, cleaning it up. Stack trace will print once cleanup is complete.", MU::WARN if !@deploy.nocleanup
             MU::MommaCat.unlockAll
@@ -262,15 +268,11 @@ module MU
         return @config
       end
 
-
-
       # Create an Amazon EC2 instance.
       def createEc2Instance
-        name = @config["name"]
-        node = @config['mu_name']
 
         instance_descriptor = {
-          :image_id => @config["ami_id"],
+          :image_id => @config["image_id"],
           :key_name => @deploy.ssh_key_name,
           :instance_type => @config["size"],
           :disable_api_termination => true,
@@ -278,64 +280,26 @@ module MU
           :max_count => 1
         }
 
-        arn = nil
-        if @config['generate_iam_role']
-          role = @deploy.findLitterMate(name: @config['name'], type: "roles")
-          s3_objs = ["#{@deploy.deploy_id}-secret", "#{role.mu_name}.pfx", "#{role.mu_name}.crt", "#{role.mu_name}.key", "#{role.mu_name}-winrm.crt", "#{role.mu_name}-winrm.key"].map { |file| 
-            'arn:'+(MU::Cloud::AWS.isGovCloud?(@config['region']) ? "aws-us-gov" : "aws")+':s3:::'+MU::Cloud::AWS.adminBucketName(@credentials)+'/'+file
-          }
-          MU.log "Adding S3 read permissions to #{@mu_name}'s IAM profile", MU::NOTICE, details: s3_objs
-          role.cloudobj.injectPolicyTargets("MuSecrets", s3_objs)
-
-          @config['iam_role'] = role.mu_name
-          arn = role.cloudobj.createInstanceProfile
-#            @cfm_role_name, @cfm_prof_name
-
-        elsif @config['iam_role'].nil?
-          raise MuError, "#{@mu_name} has generate_iam_role set to false, but no iam_role assigned."
-        end
-        if !@config["iam_role"].nil?
-          if arn
-            instance_descriptor[:iam_instance_profile] = {arn: arn}
-          else
-            instance_descriptor[:iam_instance_profile] = {name: @config["iam_role"]}
-          end
-        end
-
-        security_groups = []
-        if @dependencies.has_key?("firewall_rule")
-          @dependencies['firewall_rule'].values.each { |sg|
-            security_groups << sg.cloud_id
-          }
-        end
+        instance_descriptor[:iam_instance_profile] = getIAMProfile
 
+        security_groups = myFirewallRules.map { |fw| fw.cloud_id }
         if security_groups.size > 0
           instance_descriptor[:security_group_ids] = security_groups
         else
           raise MuError, "Didn't get any security groups assigned to be in #{@mu_name}, that shouldn't happen"
         end
 
-        if !@config['private_ip'].nil?
+        if @config['private_ip']
           instance_descriptor[:private_ip_address] = @config['private_ip']
         end
 
-        vpc_id = subnet = nil
         if !@vpc.nil? and @config.has_key?("vpc")
-          subnet_conf = @config['vpc']
-          subnet_conf = @config['vpc']['subnets'].first if @config['vpc'].has_key?("subnets") and !@config['vpc']['subnets'].empty?
-          tag_key, tag_value = subnet_conf['tag'].split(/=/, 2) if !subnet_conf['tag'].nil?
-
-          subnet = @vpc.getSubnet(
-            cloud_id: subnet_conf['subnet_id'],
-            name: subnet_conf['subnet_name'],
-            tag_key: tag_key,
-            tag_value: tag_value
-          )
+          subnet = mySubnets.sample
           if subnet.nil?
-            raise MuError, "Got null subnet id out of #{subnet_conf['vpc']}"
+            raise MuError, "Got null subnet id out of #{@config['vpc']}"
           end
-          MU.log "Deploying #{node} into VPC #{@vpc.cloud_id} Subnet #{subnet.cloud_id}"
-          punchAdminNAT
+          MU.log "Deploying #{@mu_name} into VPC #{@vpc.cloud_id} Subnet #{subnet.cloud_id}"
+          allowBastionAccess
           instance_descriptor[:subnet_id] = subnet.cloud_id
         end
 
@@ -343,38 +307,10 @@ module MU
           instance_descriptor[:user_data] = Base64.encode64(@userdata)
         end
 
-        MU::Cloud::AWS::Server.waitForAMI(@config["ami_id"], region: @config['region'], credentials: @config['credentials'])
+        MU::Cloud::AWS::Server.waitForAMI(@config["image_id"], region: @config['region'], credentials: @config['credentials'])
 
-        # Figure out which devices are embedded in the AMI already.
-        image = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_images(image_ids: [@config["ami_id"]]).images.first
-        ext_disks = {}
-        if !image.block_device_mappings.nil?
-          image.block_device_mappings.each { |disk|
-            if !disk.device_name.nil? and !disk.device_name.empty? and !disk.ebs.nil? and !disk.ebs.empty?
-              ext_disks[disk.device_name] = MU.structToHash(disk.ebs)
-            end
-          }
-        end
-
-        configured_storage = Array.new
-        cfm_volume_map = {}
-        if @config["storage"]
-          @config["storage"].each { |vol|
-            # Drop the "encrypted" flag if a snapshot for this device exists
-            # in the AMI, even if they both agree about the value of said
-            # flag. Apparently that's a thing now.
-            if ext_disks.has_key?(vol["device"])
-              if ext_disks[vol["device"]].has_key?(:snapshot_id)
-                vol.delete("encrypted")
-              end
-            end
-            mapping, cfm_mapping = MU::Cloud::AWS::Server.convertBlockDeviceMapping(vol)
-            configured_storage << mapping
-          }
-        end
+        instance_descriptor[:block_device_mappings] = MU::Cloud::AWS::Server.configureBlockDevices(image_id: @config["image_id"], storage: @config['storage'], region: @config['region'], credentials: @credentials)
 
-        instance_descriptor[:block_device_mappings] = configured_storage
-        instance_descriptor[:block_device_mappings].concat(@ephemeral_mappings)
         instance_descriptor[:monitoring] = {enabled: @config['monitoring']}
 
         if @tags and @tags.size > 0
@@ -386,37 +322,24 @@ module MU
           }]
         end
 
-        MU.log "Creating EC2 instance #{node}"
-        MU.log "Instance details for #{node}: #{instance_descriptor}", MU::DEBUG
-#				if instance_descriptor[:block_device_mappings].empty?
-#					instance_descriptor.delete(:block_device_mappings)
-#				end
+        MU.log "Creating EC2 instance #{@mu_name}", details: instance_descriptor
 
-        retries = 0
-        instance = begin
-          response = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).run_instances(instance_descriptor)
-          if response and response.instances and response.instances.size > 0
-            instance = response.instances.first
-          else
-            MU.log "halp", MU::ERR, details: response
-          end
+        instance = resp = nil
+        loop_if = Proc.new {
+          instance = resp.instances.first if resp and resp.instances
+          resp.nil? or resp.instances.nil? or instance.nil?
+        }
+
+        begin
+          MU.retrier([Aws::EC2::Errors::InvalidGroupNotFound, Aws::EC2::Errors::InvalidSubnetIDNotFound, Aws::EC2::Errors::InvalidParameterValue], loop_if: loop_if, loop_msg: "Waiting for run_instances to return #{@mu_name}") {
+            resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).run_instances(instance_descriptor)
+          }
         rescue Aws::EC2::Errors::InvalidRequest => e
           MU.log e.message, MU::ERR, details: instance_descriptor
           raise e
-        rescue Aws::EC2::Errors::InvalidGroupNotFound, Aws::EC2::Errors::InvalidSubnetIDNotFound, Aws::EC2::Errors::InvalidParameterValue => e
-          if retries < 10
-            if retries > 7
-              MU.log "Seeing #{e.inspect} while trying to launch #{node}, retrying a few more times...", MU::WARN, details: instance_descriptor
-            end
-            sleep 10
-            retries = retries + 1
-            retry
-          else
-            raise MuError, e.inspect
-          end
         end
 
-        MU.log "#{node} (#{instance.instance_id}) coming online"
+        MU.log "#{@mu_name} (#{instance.instance_id}) coming online"
 
         instance
       end
@@ -446,7 +369,7 @@ module MU
               instance_ids: [@cloud_id]
             )
             MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).wait_until(:instance_stopped, instance_ids: [@cloud_id]) do |waiter|
-              waiter.before_attempt do |attempts|
+              waiter.before_attempt do
                 MU.log "Waiting for #{@mu_name} to stop for hard reboot"
               end
             end
@@ -476,14 +399,13 @@ module MU
       # Figure out what's needed to SSH into this server.
       # @return [Array<String>]: nat_ssh_key, nat_ssh_user, nat_ssh_host, canonical_ip, ssh_user, ssh_key_name, alternate_names
       def getSSHConfig
-        node, config, deploydata = describe(cloud_id: @cloud_id)
+        cloud_desc(use_cache: false) # make sure we're current
 # XXX add some awesome alternate names from metadata and make sure they end
 # up in MU::MommaCat's ssh config wangling
-        ssh_keydir = Etc.getpwuid(Process.uid).dir+"/.ssh"
         return nil if @config.nil? or @deploy.nil?
 
         nat_ssh_key = nat_ssh_user = nat_ssh_host = nil
-        if !@config["vpc"].nil? and !MU::Cloud::AWS::VPC.haveRouteToInstance?(cloud_desc, region: @config['region'], credentials: @config['credentials'])
+        if !@config["vpc"].nil? and !MU::Cloud.resourceClass("AWS", "VPC").haveRouteToInstance?(cloud_desc, region: @config['region'], credentials: @config['credentials'])
           if !@nat.nil?
             if @nat.is_a?(Struct) && @nat.nat_gateway_id && @nat.nat_gateway_id.start_with?("nat-")
               raise MuError, "Configured to use NAT Gateway, but I have no route to instance. Either use Bastion, or configure VPC peering"
@@ -521,450 +443,81 @@ module MU
       # Apply tags, bootstrap our configuration management, and other
       # administravia for a new instance.
       def postBoot(instance_id = nil)
-        if !instance_id.nil?
-          @cloud_id = instance_id
-        end
-        node, config, deploydata = describe(cloud_id: @cloud_id)
-        instance = cloud_desc
-        raise MuError, "Couldn't find instance #{@mu_name} (#{@cloud_id})" if !instance
-        @cloud_id = instance.instance_id
-        return false if !MU::MommaCat.lock(instance.instance_id+"-orchestrate", true)
-        return false if !MU::MommaCat.lock(instance.instance_id+"-groom", true)
-
-        MU::Cloud::AWS.createStandardTags(instance.instance_id, region: @config['region'], credentials: @config['credentials'])
-        MU::MommaCat.createTag(instance.instance_id, "Name", node, region: @config['region'], credentials: @config['credentials'])
-
-        if @config['optional_tags']
-          MU::MommaCat.listOptionalTags.each { |key, value|
-            MU::MommaCat.createTag(instance.instance_id, key, value, region: @config['region'], credentials: @config['credentials'])
-          }
-        end
+        @cloud_id ||= instance_id
+        _node, _config, deploydata = describe(cloud_id: @cloud_id)
+
+        raise MuError, "Couldn't find instance #{@mu_name} (#{@cloud_id})" if !cloud_desc
+        return false if !MU::MommaCat.lock(@cloud_id+"-orchestrate", true)
+        return false if !MU::MommaCat.lock(@cloud_id+"-groom", true)
+        finish = Proc.new { |status|
+          MU::MommaCat.unlock(@cloud_id+"-orchestrate")
+          MU::MommaCat.unlock(@cloud_id+"-groom")
+          return status
+        }
 
-        if !@config['tags'].nil?
-          @config['tags'].each { |tag|
-            MU::MommaCat.createTag(instance.instance_id, tag['key'], tag['value'], region: @config['region'], credentials: @config['credentials'])
-          }
-        end
-        MU.log "Tagged #{node} (#{instance.instance_id}) with MU-ID=#{MU.deploy_id}", MU::DEBUG
+        MU::Cloud::AWS.createStandardTags(
+          @cloud_id,
+          region: @config['region'],
+          credentials: @config['credentials'],
+          optional: @config['optional_tags'],
+          nametag: @mu_name,
+          othertags: @config['tags']
+        )
 
         # Make double sure we don't lose a cached mu_windows_name value.
-        if windows? or !@config['active_directory'].nil?
-          if @mu_windows_name.nil?
-            @mu_windows_name = deploydata['mu_windows_name']
-          end
+        if (windows? or !@config['active_directory'].nil?)
+          @mu_windows_name ||= deploydata['mu_windows_name']
         end
 
-        retries = -1
-        max_retries = 30
-        begin
-          if instance.nil? or instance.state.name != "running"
-            retries = retries + 1
-            if !instance.nil? and instance.state.name == "terminated"
-              raise MuError, "#{@cloud_id} appears to have been terminated mid-bootstrap!"
-            end
-            if retries % 3 == 0
-              MU.log "Waiting for EC2 instance #{node} (#{@cloud_id}) to be ready...", MU::NOTICE
-            end
-            sleep 40
-            # Get a fresh AWS descriptor
-            instance = MU::Cloud::Server.find(cloud_id: @cloud_id, region: @config['region'], credentials: @config['credentials']).values.first
-            if instance and instance.state.name == "terminated"
-              raise MuError, "EC2 instance #{node} (#{@cloud_id}) terminating during bootstrap!"
-            end
+        loop_if = Proc.new {
+          !cloud_desc(use_cache: false) or cloud_desc.state.name != "running"
+        }
+        MU.retrier([Aws::EC2::Errors::ServiceError], max: 30, wait: 40, loop_if: loop_if) { |retries, _wait|
+          if cloud_desc and cloud_desc.state.name == "terminated"
+            raise MuError, "#{@cloud_id} appears to have been terminated mid-bootstrap!"
           end
-        rescue Aws::EC2::Errors::ServiceError => e
-          if retries < max_retries
-            MU.log "Got #{e.inspect} during initial instance creation of #{@cloud_id}, retrying...", MU::NOTICE, details: instance
-            retries = retries + 1
-            retry
-          else
-            raise MuError, "Too many retries creating #{node} (#{e.inspect})"
+          if retries % 3 == 0
+            MU.log "Waiting for EC2 instance #{@mu_name} (#{@cloud_id}) to be ready...", MU::NOTICE
           end
-        end while instance.nil? or (instance.state.name != "running" and retries < max_retries)
-
-        punchAdminNAT
-
-
-        # If we came up via AutoScale, the Alarm module won't have had our
-        # instance ID to associate us with itself. So invoke that here.
-        # XXX might be possible to do this with regular alarm resources and
-        # dependencies now
-        if !@config['basis'].nil? and @config["alarms"] and !@config["alarms"].empty?
-          @config["alarms"].each { |alarm|
-            alarm_obj = MU::MommaCat.findStray(
-              "AWS",
-              "alarms",
-              region: @config["region"],
-              deploy_id: @deploy.deploy_id,
-              name: alarm['name']
-            ).first
-            alarm["dimensions"] = [{:name => "InstanceId", :value => @cloud_id}]
-
-            if alarm["enable_notifications"]
-              topic_arn = MU::Cloud::AWS::Notification.createTopic(alarm["notification_group"], region: @config["region"], credentials: @config['credentials'])
-              MU::Cloud::AWS::Notification.subscribe(arn: topic_arn, protocol: alarm["notification_type"], endpoint: alarm["notification_endpoint"], region: @config["region"], credentials: @config["credentials"])
-              alarm["alarm_actions"] = [topic_arn]
-              alarm["ok_actions"]  = [topic_arn]
-            end
+        }
 
-            alarm_name = alarm_obj ? alarm_obj.cloud_id : "#{node}-#{alarm['name']}".upcase
-
-            MU::Cloud::AWS::Alarm.setAlarm(
-              name: alarm_name,
-              ok_actions: alarm["ok_actions"],
-              alarm_actions: alarm["alarm_actions"],
-              insufficient_data_actions: alarm["no_data_actions"],
-              metric_name: alarm["metric_name"],
-              namespace: alarm["namespace"],
-              statistic: alarm["statistic"],
-              dimensions: alarm["dimensions"],
-              period: alarm["period"],
-              unit: alarm["unit"],
-              evaluation_periods: alarm["evaluation_periods"],
-              threshold: alarm["threshold"],
-              comparison_operator: alarm["comparison_operator"],
-              region: @config["region"],
-              credentials: @config['credentials']
-            )
-          }
-        end
+        allowBastionAccess
 
-        # We have issues sometimes where our dns_records are pointing at the wrong node name and IP address.
-        # Make sure that doesn't happen. Happens with server pools only
-        if @config['dns_records'] && !@config['dns_records'].empty?
-          @config['dns_records'].each { |dnsrec|
-            if dnsrec.has_key?("name")
-              if dnsrec['name'].start_with?(MU.deploy_id.downcase) && !dnsrec['name'].start_with?(node.downcase)
-                MU.log "DNS records for #{node} seem to be wrong, deleting from current config", MU::WARN, details: dnsrec
-                dnsrec.delete('name')
-                dnsrec.delete('target')
-              end
-            end
-          }
-        end
+        setAlarms
 
         # Unless we're planning on associating a different IP later, set up a
         # DNS entry for this thing and let it sync in the background. We'll come
         # back to it later.
-        if @config['static_ip'].nil? && !@named
+        if @config['static_ip'].nil? and !@named
           MU::MommaCat.nameKitten(self)
           @named = true
         end
 
         if !@config['src_dst_check'] and !@config["vpc"].nil?
-          MU.log "Disabling source_dest_check #{node} (making it NAT-worthy)"
+          MU.log "Disabling source_dest_check #{@mu_name} (making it NAT-worthy)"
           MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).modify_instance_attribute(
-              instance_id: @cloud_id,
-              source_dest_check: {:value => false}
+            instance_id: @cloud_id,
+            source_dest_check: { value: false }
           )
         end
 
         # Set console termination protection. Autoscale nodes won't set this
         # by default.
         MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).modify_instance_attribute(
-            instance_id: @cloud_id,
-            disable_api_termination: {:value => true}
+          instance_id: @cloud_id,
+          disable_api_termination: { value: true}
         )
 
-        has_elastic_ip = false
-        if !instance.public_ip_address.nil?
-          begin
-            resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_addresses(public_ips: [instance.public_ip_address])
-            if resp.addresses.size > 0 and resp.addresses.first.instance_id == @cloud_id
-              has_elastic_ip = true
-            end
-          rescue Aws::EC2::Errors::InvalidAddressNotFound => e
-            # XXX this is ok to ignore, it means the public IP isn't Elastic
-          end
-        end
-
-        win_admin_password = nil
-        ec2config_password = nil
-        sshd_password = nil
-        if windows?
-          ssh_keydir = "#{Etc.getpwuid(Process.uid).dir}/.ssh"
-          ssh_key_name = @deploy.ssh_key_name
-
-          if @config['use_cloud_provider_windows_password']
-            win_admin_password = getWindowsAdminPassword
-          elsif @config['windows_auth_vault'] && !@config['windows_auth_vault'].empty?
-            if @config["windows_auth_vault"].has_key?("password_field")
-              win_admin_password = @groomer.getSecret(
-                  vault: @config['windows_auth_vault']['vault'],
-                  item: @config['windows_auth_vault']['item'],
-                  field: @config["windows_auth_vault"]["password_field"]
-              )
-            else
-              win_admin_password = getWindowsAdminPassword
-            end
-
-            if @config["windows_auth_vault"].has_key?("ec2config_password_field")
-              ec2config_password = @groomer.getSecret(
-                  vault: @config['windows_auth_vault']['vault'],
-                  item: @config['windows_auth_vault']['item'],
-                  field: @config["windows_auth_vault"]["ec2config_password_field"]
-              )
-            end
-
-            if @config["windows_auth_vault"].has_key?("sshd_password_field")
-              sshd_password = @groomer.getSecret(
-                  vault: @config['windows_auth_vault']['vault'],
-                  item: @config['windows_auth_vault']['item'],
-                  field: @config["windows_auth_vault"]["sshd_password_field"]
-              )
-            end
-          end
-
-          win_admin_password = MU.generateWindowsPassword if win_admin_password.nil?
-          ec2config_password = MU.generateWindowsPassword if ec2config_password.nil?
-          sshd_password = MU.generateWindowsPassword if sshd_password.nil?
-
-          # We're creating the vault here so when we run
-          # MU::Cloud::Server.initialSSHTasks and we need to set the Windows
-          # Admin password we can grab it from said vault.
-          creds = {
-              "username" => @config['windows_admin_username'],
-              "password" => win_admin_password,
-              "ec2config_username" => "ec2config",
-              "ec2config_password" => ec2config_password,
-              "sshd_username" => "sshd_service",
-              "sshd_password" => sshd_password
-          }
-          @groomer.saveSecret(vault: @mu_name, item: "windows_credentials", data: creds, permissions: "name:#{@mu_name}")
-        end
-
-        subnet = nil
-        if !@vpc.nil? and @config.has_key?("vpc") and !instance.subnet_id.nil?
-          subnet = @vpc.getSubnet(
-            cloud_id: instance.subnet_id
-          )
-          if subnet.nil?
-            raise MuError, "Got null subnet id out of #{@config['vpc']} when asking for #{instance.subnet_id}"
-          end
-        end
-
-        if !subnet.nil?
-          if !subnet.private? or (!@config['static_ip'].nil? and !@config['static_ip']['assign_ip'].nil?)
-            if !@config['static_ip'].nil?
-              if !@config['static_ip']['ip'].nil?
-                public_ip = MU::Cloud::AWS::Server.associateElasticIp(instance.instance_id, classic: false, ip: @config['static_ip']['ip'])
-              elsif !has_elastic_ip
-                public_ip = MU::Cloud::AWS::Server.associateElasticIp(instance.instance_id)
-              end
-            end
-          end
-
-          nat_ssh_key, nat_ssh_user, nat_ssh_host, canonical_ip, ssh_user, ssh_key_name = getSSHConfig
-          if subnet.private? and !nat_ssh_host and !MU::Cloud::AWS::VPC.haveRouteToInstance?(cloud_desc, region: @config['region'], credentials: @config['credentials'])
-            raise MuError, "#{node} is in a private subnet (#{subnet}), but has no bastion host configured, and I have no other route to it"
-          end
-
-          # If we've asked for additional subnets (and this @config is not a
-          # member of a Server Pool, which has different semantics), create
-          # extra interfaces to accomodate.
-          if !@config['vpc']['subnets'].nil? and @config['basis'].nil?
-            device_index = 1
-            @vpc.subnets.each { |s|
-              subnet_id = s.cloud_id
-              MU.log "Adding network interface on subnet #{subnet_id} for #{node}"
-              iface = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).create_network_interface(subnet_id: subnet_id).network_interface
-              MU::Cloud::AWS.createStandardTags(iface.network_interface_id, region: @config['region'], credentials: @config['credentials'])
-              MU::MommaCat.createTag(iface.network_interface_id, "Name", node+"-ETH"+device_index.to_s, region: @config['region'], credentials: @config['credentials'])
-
-              if @config['optional_tags']
-                MU::MommaCat.listOptionalTags.each { |key, value|
-                  MU::MommaCat.createTag(iface.network_interface_id, key, value, region: @config['region'], credentials: @config['credentials'])
-                }
-              end
-
-              if !@config['tags'].nil?
-                @config['tags'].each { |tag|
-                  MU::MommaCat.createTag(iface.network_interface_id, tag['key'], tag['value'], region: @config['region'], credentials: @config['credentials'])
-                }
-              end
-
-              MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).attach_network_interface(
-                  network_interface_id: iface.network_interface_id,
-                  instance_id: instance.instance_id,
-                  device_index: device_index
-              )
-              device_index = device_index + 1
-            }
-          end
-        elsif !@config['static_ip'].nil?
-          if !@config['static_ip']['ip'].nil?
-            public_ip = MU::Cloud::AWS::Server.associateElasticIp(instance.instance_id, classic: true, ip: @config['static_ip']['ip'])
-          elsif !has_elastic_ip
-            public_ip = MU::Cloud::AWS::Server.associateElasticIp(instance.instance_id, classic: true)
-          end
-        end
-
+        tagVolumes
+        configureNetworking
+        saveCredentials
 
         if !@config['image_then_destroy']
           notify
         end
 
-        MU.log "EC2 instance #{node} has id #{instance.instance_id}", MU::DEBUG
-
-        @config["private_dns_name"] = instance.private_dns_name
-        @config["public_dns_name"] = instance.public_dns_name
-        @config["private_ip_address"] = instance.private_ip_address
-        @config["public_ip_address"] = instance.public_ip_address
-
-        ext_mappings = MU.structToHash(instance.block_device_mappings)
-
-        # Root disk on standard CentOS AMI
-        # tagVolumes(instance.instance_id, "/dev/sda", "Name", "ROOT-"+MU.deploy_id+"-"+@config["name"].upcase)
-        # Root disk on standard Ubuntu AMI
-        # tagVolumes(instance.instance_id, "/dev/sda1", "Name", "ROOT-"+MU.deploy_id+"-"+@config["name"].upcase)
-
-        # Generic deploy ID tag
-        # tagVolumes(instance.instance_id)
-
-        # Tag volumes with all our standard tags.
-        # Maybe replace tagVolumes with this? There is one more place tagVolumes is called from
-        volumes = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_volumes(filters: [name: "attachment.instance-id", values: [instance.instance_id]])
-        volumes.each { |vol|
-          vol.volumes.each { |volume|
-            volume.attachments.each { |attachment|
-              MU::MommaCat.listStandardTags.each_pair { |key, value|
-                MU::MommaCat.createTag(attachment.volume_id, key, value, region: @config['region'], credentials: @config['credentials'])
-
-                if attachment.device == "/dev/sda" or attachment.device == "/dev/sda1"
-                  MU::MommaCat.createTag(attachment.volume_id, "Name", "ROOT-#{MU.deploy_id}-#{@config["name"].upcase}", region: @config['region'], credentials: @config['credentials'])
-                else
-                  MU::MommaCat.createTag(attachment.volume_id, "Name", "#{MU.deploy_id}-#{@config["name"].upcase}-#{attachment.device.upcase}", region: @config['region'], credentials: @config['credentials'])
-                end
-              }
-
-              if @config['optional_tags']
-                MU::MommaCat.listOptionalTags.each { |key, value|
-                  MU::MommaCat.createTag(attachment.volume_id, key, value, region: @config['region'], credentials: @config['credentials'])
-                }
-              end
-
-              if @config['tags']
-                @config['tags'].each { |tag|
-                  MU::MommaCat.createTag(attachment.volume_id, tag['key'], tag['value'], region: @config['region'], credentials: @config['credentials'])
-                }
-              end
-            }
-          }
-        }
-
-        canonical_name = instance.public_dns_name
-        canonical_name = instance.private_dns_name if !canonical_name or nat_ssh_host != nil
-        @config['canonical_name'] = canonical_name
-
-        if !@config['add_private_ips'].nil?
-          instance.network_interfaces.each { |int|
-            if int.private_ip_address == instance.private_ip_address and int.private_ip_addresses.size < (@config['add_private_ips'] + 1)
-              MU.log "Adding #{@config['add_private_ips']} extra private IP addresses to #{instance.instance_id}"
-              MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).assign_private_ip_addresses(
-                  network_interface_id: int.network_interface_id,
-                  secondary_private_ip_address_count: @config['add_private_ips'],
-                  allow_reassignment: false
-              )
-            end
-          }
-          notify
-        end
-
-        begin
-          if @config['groom'].nil? or @config['groom']
-            if windows?
-              # kick off certificate generation early; WinRM will need it
-              cert, key = @deploy.nodeSSLCerts(self)
-              if @config.has_key?("basis")
-                @deploy.nodeSSLCerts(self, true)
-              end
-              if !@groomer.haveBootstrapped?
-                session = getWinRMSession(50, 60, reboot_on_problems: true)
-                initialWinRMTasks(session)
-                begin
-                  session.close
-                rescue Exception
-                  # this is allowed to fail- we're probably rebooting anyway
-                end
-              else # for an existing Windows node: WinRM, then SSH if it fails
-                begin
-                  session = getWinRMSession(1, 60)
-                rescue Exception # yeah, yeah
-                  session = getSSHSession(1, 60)
-                  # XXX maybe loop at least once if this also fails?
-                end
-              end
-            else
-              session = getSSHSession(40, 30)
-              initialSSHTasks(session)
-            end
-          end
-        rescue BootstrapTempFail
-          sleep 45
-          retry
-        ensure
-          session.close if !session.nil? and !windows?
-        end
-
-        if @config["existing_deploys"] && !@config["existing_deploys"].empty?
-          @config["existing_deploys"].each { |ext_deploy|
-            if ext_deploy["cloud_id"]
-              found = MU::MommaCat.findStray(
-                @config['cloud'],
-                ext_deploy["cloud_type"],
-                cloud_id: ext_deploy["cloud_id"],
-                region: @config['region'],
-                dummy_ok: false
-              ).first
-
-              MU.log "Couldn't find existing resource #{ext_deploy["cloud_id"]}, #{ext_deploy["cloud_type"]}", MU::ERR if found.nil?
-              @deploy.notify(ext_deploy["cloud_type"], found.config["name"], found.deploydata, mu_name: found.mu_name, triggering_node: @mu_name)
-            elsif ext_deploy["mu_name"] && ext_deploy["deploy_id"]
-              MU.log "#{ext_deploy["mu_name"]} / #{ext_deploy["deploy_id"]}"
-              found = MU::MommaCat.findStray(
-                @config['cloud'],
-                ext_deploy["cloud_type"],
-                deploy_id: ext_deploy["deploy_id"],
-                mu_name: ext_deploy["mu_name"],
-                region: @config['region'],
-                dummy_ok: false
-              ).first
-
-              MU.log "Couldn't find existing resource #{ext_deploy["mu_name"]}/#{ext_deploy["deploy_id"]}, #{ext_deploy["cloud_type"]}", MU::ERR if found.nil?
-              @deploy.notify(ext_deploy["cloud_type"], found.config["name"], found.deploydata, mu_name: ext_deploy["mu_name"], triggering_node: @mu_name)
-            else
-              MU.log "Trying to find existing deploy, but either the cloud_id is not valid or no mu_name and deploy_id where provided", MU::ERR
-            end
-          }
-        end
-
-        # See if this node already exists in our config management. If it does,
-        # we're done.
-        if MU.inGem?
-          MU.log "Deploying from a gem, not grooming"
-          MU::MommaCat.unlock(instance.instance_id+"-orchestrate")
-          MU::MommaCat.unlock(instance.instance_id+"-groom")
-
-          return true
-        elsif @groomer.haveBootstrapped?
-          MU.log "Node #{node} has already been bootstrapped, skipping groomer setup.", MU::NOTICE
-
-          if @config['groom'].nil? or @config['groom']
-            @groomer.saveDeployData
-          end
-
-          MU::MommaCat.unlock(instance.instance_id+"-orchestrate")
-          MU::MommaCat.unlock(instance.instance_id+"-groom")
-          return true
-        end
-
-        begin
-          @groomer.bootstrap if @config['groom'].nil? or @config['groom']
-        rescue MU::Groomer::RunError
-          MU::MommaCat.unlock(instance.instance_id+"-groom")
-          MU::MommaCat.unlock(instance.instance_id+"-orchestrate")
-          return false
-        end
+        getIAMProfile
+        finish.call(false) if !bootstrapGroomer
 
         # Make sure we got our name written everywhere applicable
         if !@named
@@ -972,149 +525,83 @@ module MU
           @named = true
         end
 
-        MU::MommaCat.unlock(instance.instance_id+"-groom")
-        MU::MommaCat.unlock(instance.instance_id+"-orchestrate")
-        return true
-      end
-
-      # postBoot
+        finish.call(true)
+      end #postboot 
 
       # Locate an existing instance or instances and return an array containing matching AWS resource descriptors for those that match.
       # @return [Hash<String,OpenStruct>]: The cloud provider's complete descriptions of matching instances
       def self.find(**args)
         ip ||= args[:flags]['ip'] if args[:flags] and args[:flags]['ip']
 
-        instance = nil
-        if !args[:region].nil?
-          regions = [args[:region]]
-        else
-          regions = MU::Cloud::AWS.listRegions
-        end
+        regions = args[:region].nil? ? MU::Cloud::AWS.listRegions : [args[:region]]
 
         found = {}
         search_semaphore = Mutex.new
         search_threads = []
 
-        if !ip and !args[:cloud_id] and !args[:tag_value]
-          regions.each { |r|
-            search_threads << Thread.new {
-              MU::Cloud::AWS.ec2(region: r, credentials: args[:credentials]).describe_instances(
-                filters: [
-                  {
-                    name: "instance-state-name",
-                    values: ["running", "pending", "stopped"]
-                  }
-                ]
-              ).reservations.each { |resp|
-                if !resp.nil? and !resp.instances.nil?
-                  resp.instances.each { |i|
-                    search_semaphore.synchronize {
-                      found[i.instance_id] = i
-                    }
-                  }
-                end
-              }
-            }
-          }
+        base_filter = { name: "instance-state-name", values: ["running", "pending", "stopped"] }
+        searches = []
 
-          search_threads.each { |t|
-            t.join
+        if args[:cloud_id]
+          searches << {
+            :instance_ids => [args[:cloud_id]],
+            :filters => [base_filter]
           }
-
-          return found
         end
 
-        # If we got an instance id, go get it
-        if args[:cloud_id]
-          regions.each { |r|
-            search_threads << Thread.new {
-              MU.log "Hunting for instance with cloud id '#{args[:cloud_id]}' in #{r}", MU::DEBUG
-              retries = 0
-              begin
-                MU::Cloud::AWS.ec2(region: r, credentials: args[:credentials]).describe_instances(
-                  instance_ids: [args[:cloud_id]],
-                  filters: [
-                    {
-                      name: "instance-state-name",
-                      values: ["running", "pending", "stopped"]
-                    }
-                  ]
-                ).reservations.each { |resp|
-                  if !resp.nil? and !resp.instances.nil?
-                    resp.instances.each { |i|
-                      search_semaphore.synchronize {
-                        found[i.instance_id] = i
-                      }
-                    }
-                  end
-                }
-              rescue Aws::EC2::Errors::InvalidInstanceIDNotFound => e
-                if retries < 5
-                  retries = retries + 1
-                  sleep 5
-                else
-                  raise MuError, "#{e.inspect} in region #{r}"
-                end
-              end
+        if ip
+          ["ip-address", "private-ip-address"].each { |ip_type|
+            searches << {
+              filters: [base_filter,  {name: ip_type, values: [ip]} ],
             }
           }
-          done_threads = []
-          begin
-            search_threads.each { |t|
-              joined = t.join(2)
-              done_threads << joined if !joined.nil?
-            }
-          end while found.size < 1 and done_threads.size != search_threads.size
         end
 
-        return found if found.size > 0
-
-        # Ok, well, let's try looking it up by IP then
-        if !ip.nil?
-          MU.log "Hunting for instance by IP '#{ip}'", MU::DEBUG
-          ["ip-address", "private-ip-address"].each { |filter|
-            regions.each { |r|
-              response = MU::Cloud::AWS.ec2(region: r, credentials: args[:credentials]).describe_instances(
-                filters: [
-                  {name: filter, values: [ip]},
-                  {name: "instance-state-name", values: ["running", "pending", "stopped"]}
-                ]
-              ).reservations.first
-              response.instances.each { |i|
-                found[i.instance_id] = i
-              }
-            }
+        if args[:tag_value] and args[:tag_key]
+          searches << {
+            filters: [
+              base_filter,
+              {name: ip_type, values: [ip]},
+              {name: "tag:#{args[:tag_key]}", values: [args[:tag_value]]},
+            ]
           }
         end
 
-        return found if found.size > 0
+        if searches.empty?
+          searches << { filters: [base_filter] }
+        end
 
-        # Fine, let's try it by tag.
-        if args[:tag_value]
-          MU.log "Searching for instance by tag '#{args[:tag_key]}=#{args[:tag_value]}'", MU::DEBUG
-          regions.each { |r|
-            MU::Cloud::AWS.ec2(region: r, credentials: args[:credentials]).describe_instances(
-              filters: [
-                {name: "tag:#{args[:tag_key]}", values: [args[:tag_value]]},
-                {name: "instance-state-name", values: ["running", "pending", "stopped"]}
-              ]
-            ).reservations.each { |resp|
-              if !resp.nil? and resp.instances.size > 0
-                resp.instances.each { |i|
-                  found[i.instance_id] = i
+        regions.each { |r|
+          searches.each { |search|
+            search_threads << Thread.new(search) { |params|
+              MU.retrier([Aws::EC2::Errors::InvalidInstanceIDNotFound], wait: 5, max: 5, ignoreme: [Aws::EC2::Errors::InvalidInstanceIDNotFound]) {
+                MU::Cloud::AWS.ec2(region: r, credentials: args[:credentials]).describe_instances(params).reservations.each { |resp|
+                  next if resp.nil? or resp.instances.nil?
+                  resp.instances.each { |i|
+                    search_semaphore.synchronize {
+                      found[i.instance_id] = i
+                    }
+                  }
                 }
-              end
+              }
             }
           }
-        end
-
-        return found
+        }
+        done_threads = []
+        begin
+          search_threads.each { |t|
+            joined = t.join(2)
+            done_threads << joined if !joined.nil?
+          }
+        end while found.size < 1 and done_threads.size != search_threads.size
+
+        return found
       end
 
       # Reverse-map our cloud description into a runnable config hash.
       # We assume that any values we have in +@config+ are placeholders, and
       # calculate our own accordingly based on what's live in the cloud.
-      def toKitten(rootparent: nil, billing: nil, habitats: nil)
+      def toKitten(**_args)
         bok = {
           "cloud" => "AWS",
           "credentials" => @config['credentials'],
@@ -1127,7 +614,7 @@ module MU
           return nil
         end
 
-        asgs = MU::Cloud::AWS::ServerPool.find(
+        asgs = MU::Cloud.resourceClass("AWS", "ServerPool").find(
           instance_id: @cloud_id,
           region: @config['region'],
           credentials: @credentials
@@ -1221,8 +708,8 @@ module MU
 
           int.private_ip_addresses.each { |priv_ip|
             if !priv_ip.primary
-              bok['add_private_ips'] ||= []
-              bok['add_private_ips'] << priv_ip.private_ip_address
+              bok['add_private_ips'] ||= 0
+              bok['add_private_ips'] += 1
             end
             if priv_ip.association and priv_ip.association.public_ip 
               bok['associate_public_ip'] = true
@@ -1237,15 +724,15 @@ module MU
 
           if int.groups.size > 0
 
-            require 'mu/clouds/aws/firewall_rule'
-            ifaces = MU::Cloud::AWS::FirewallRule.getAssociatedInterfaces(int.groups.map { |sg| sg.group_id }, credentials: @credentials, region: @config['region'])
+            require 'mu/providers/aws/firewall_rule'
+            ifaces = MU::Cloud.resourceClass("AWS", "FirewallRule").getAssociatedInterfaces(int.groups.map { |sg| sg.group_id }, credentials: @credentials, region: @config['region'])
             done_local_rules = false
             int.groups.each { |sg|
               if !done_local_rules and ifaces[sg.group_id].size == 1
-                sg_desc = MU::Cloud::AWS::FirewallRule.find(cloud_id: sg.group_id, credentials: @credentials, region: @config['region']).values.first
+                sg_desc = MU::Cloud.resourceClass("AWS", "FirewallRule").find(cloud_id: sg.group_id, credentials: @credentials, region: @config['region']).values.first
                 if sg_desc
-                  bok["ingress_rules"] = MU::Cloud::AWS::FirewallRule.rulesToBoK(sg_desc.ip_permissions)
-                  bok["ingress_rules"].concat(MU::Cloud::AWS::FirewallRule.rulesToBoK(sg_desc.ip_permissions_egress, egress: true))
+                  bok["ingress_rules"] = MU::Cloud.resourceClass("AWS", "FirewallRule").rulesToBoK(sg_desc.ip_permissions)
+                  bok["ingress_rules"].concat(MU::Cloud.resourceClass("AWS", "FirewallRule").rulesToBoK(sg_desc.ip_permissions_egress, egress: true))
                   done_local_rules = true
                   next
                 end
@@ -1270,9 +757,6 @@ module MU
         # Return a description of this resource appropriate for deployment
         # metadata. Arguments reflect the return values of the MU::Cloud::[Resource].describe method
         def notify
-          node, config, deploydata = describe(cloud_id: @cloud_id, update_cache: true)
-          deploydata = {} if deploydata.nil?
-
           if cloud_desc.nil?
             raise MuError, "Failed to load instance metadata for #{@mu_name}/#{@cloud_id}"
           end
@@ -1317,52 +801,16 @@ module MU
           end
           deploydata["region"] = @config['region'] if !@config['region'].nil?
           if !@named
-            MU::MommaCat.nameKitten(self)
+            MU::MommaCat.nameKitten(self, no_dns: true)
             @named = true
           end
 
           return deploydata
         end
 
-        # If the specified server is in a VPC, and has a NAT, make sure we'll
-        # be letting ssh traffic in from said NAT.
-        def punchAdminNAT
-          if @config['vpc'].nil? or 
-            (
-              !@config['vpc'].has_key?("nat_host_id") and
-              !@config['vpc'].has_key?("nat_host_tag") and
-              !@config['vpc'].has_key?("nat_host_ip") and
-              !@config['vpc'].has_key?("nat_host_name")
-            )
-            return nil
-          end
-
-          return nil if @nat.is_a?(Struct) && @nat.nat_gateway_id && @nat.nat_gateway_id.start_with?("nat-")
-
-          dependencies if @nat.nil?
-          if @nat.nil? or @nat.cloud_desc.nil?
-            raise MuError, "#{@mu_name} (#{MU.deploy_id}) is configured to use #{@config['vpc']} but I can't find the cloud descriptor for a matching NAT instance"
-          end
-          MU.log "Adding administrative holes for NAT host #{@nat.cloud_desc.private_ip_address} to #{@mu_name}"
-          if !@deploy.kittens['firewall_rules'].nil?
-            @deploy.kittens['firewall_rules'].each_pair { |name, acl|
-              if acl.config["admin"]
-                acl.addRule([@nat.cloud_desc.private_ip_address], proto: "tcp")
-                acl.addRule([@nat.cloud_desc.private_ip_address], proto: "udp")
-                acl.addRule([@nat.cloud_desc.private_ip_address], proto: "icmp")
-              end
-            }
-          end
-        end
-
         # Called automatically by {MU::Deploy#createResources}
         def groom
           MU::MommaCat.lock(@cloud_id+"-groom")
-          node, config, deploydata = describe(cloud_id: @cloud_id)
-
-          if node.nil? or node.empty?
-            raise MuError, "MU::Cloud::AWS::Server.groom was called without a mu_name"
-          end
 
           # Make double sure we don't lose a cached mu_windows_name value.
           if windows? or !@config['active_directory'].nil?
@@ -1371,9 +819,9 @@ module MU
             end
           end
 
-          punchAdminNAT
+          allowBastionAccess
 
-          MU::Cloud::AWS::Server.tagVolumes(@cloud_id, credentials: @config['credentials'])
+          tagVolumes
 
           # If we have a loadbalancer configured, attach us to it
           if !@config['loadbalancers'].nil?
@@ -1402,55 +850,31 @@ module MU
           end
 
           begin
+            getIAMProfile
+
+            dbs = @deploy.findLitterMate(type: "database", return_all: true)
+            if dbs
+              dbs.each_pair { |sib_name, sib|
+                @groomer.groomer_class.grantSecretAccess(@mu_name, sib_name, "database_credentials")
+                if sib.config and sib.config['auth_vault']
+                  @groomer.groomer_class.grantSecretAccess(@mu_name, sib.config['auth_vault']['vault'], sib.config['auth_vault']['item'])
+                end
+              }
+            end
+
             if @config['groom'].nil? or @config['groom']
-              @groomer.run(purpose: "Full Initial Run", max_retries: 15, reboot_first_fail: windows?, timeout: @config['groomer_timeout'])
+              @groomer.run(purpose: "Full Initial Run", max_retries: 15, reboot_first_fail: (windows? and @config['groomer'] != "Ansible"), timeout: @config['groomer_timeout'])
             end
           rescue MU::Groomer::RunError => e
-            MU.log "Proceeding after failed initial Groomer run, but #{node} may not behave as expected!", MU::WARN, details: e.message
-          rescue Exception => e
-            MU.log "Caught #{e.inspect} on #{node} in an unexpected place (after @groomer.run on Full Initial Run)", MU::ERR
+            raise e if !@config['create_image'].nil? and !@config['image_created']
+            MU.log "Proceeding after failed initial Groomer run, but #{@mu_name} may not behave as expected!", MU::WARN, details: e.message
+          rescue StandardError => e
+            raise e if !@config['create_image'].nil? and !@config['image_created']
+            MU.log "Caught #{e.inspect} on #{@mu_name} in an unexpected place (after @groomer.run on Full Initial Run)", MU::ERR
           end
 
           if !@config['create_image'].nil? and !@config['image_created']
-            img_cfg = @config['create_image']
-            # Scrub things that don't belong on an AMI
-            session = getSSHSession
-            sudo = purgecmd = ""
-            sudo = "sudo" if @config['ssh_user'] != "root"
-            if windows?
-              purgecmd = "rm -rf /cygdrive/c/mu_installed_chef"
-            else
-              purgecmd = "rm -rf /opt/mu_installed_chef"
-            end
-            if img_cfg['image_then_destroy']
-              if windows?
-                purgecmd = "rm -rf /cygdrive/c/chef/ /home/#{@config['windows_admin_username']}/.ssh/authorized_keys /home/Administrator/.ssh/authorized_keys /cygdrive/c/mu-installer-ran-updates /cygdrive/c/mu_installed_chef"
-                # session.exec!("powershell -Command \"& {(Get-WmiObject -Class Win32_Product -Filter \"Name='UniversalForwarder'\").Uninstall()}\"")
-              else
-                purgecmd = "#{sudo} rm -rf /var/lib/cloud/instances/i-* /root/.ssh/authorized_keys /etc/ssh/ssh_host_*key* /etc/chef /etc/opscode/* /.mu-installer-ran-updates /var/chef /opt/mu_installed_chef /opt/chef ; #{sudo} sed -i 's/^HOSTNAME=.*//' /etc/sysconfig/network"
-              end
-            end
-            session.exec!(purgecmd)
-            session.close
-            ami_ids = MU::Cloud::AWS::Server.createImage(
-                name: @mu_name,
-                instance_id: @cloud_id,
-                storage: @config['storage'],
-                exclude_storage: img_cfg['image_exclude_storage'],
-                copy_to_regions: img_cfg['copy_to_regions'],
-                make_public: img_cfg['public'],
-                region: @config['region'],
-                tags: @config['tags'],
-                credentials: @config['credentials']
-            )
-            @deploy.notify("images", @config['name'], ami_ids)
-            @config['image_created'] = true
-            if img_cfg['image_then_destroy']
-              MU::Cloud::AWS::Server.waitForAMI(ami_ids[@config['region']], region: @config['region'], credentials: @config['credentials'])
-              MU.log "AMI #{ami_ids[@config['region']]} ready, removing source node #{node}"
-              MU::Cloud::AWS::Server.terminateInstance(id: @cloud_id, region: @config['region'], deploy_id: @deploy.deploy_id, mu_name: @mu_name, credentials: @config['credentials'])
-              destroy
-            end
+            createImage
           end
 
           MU::MommaCat.unlock(@cloud_id+"-groom")
@@ -1462,9 +886,12 @@ module MU
           "arn:"+(MU::Cloud::AWS.isGovCloud?(@config["region"]) ? "aws-us-gov" : "aws")+":ec2:"+@config['region']+":"+MU::Cloud::AWS.credToAcct(@config['credentials'])+":instance/"+@cloud_id
         end
 
+        @cloud_desc_cache = nil
         # Return the cloud provider's description for this instance
         # @return [Openstruct]
-        def cloud_desc
+        def cloud_desc(use_cache: true)
+          return @cloud_desc_cache if @cloud_desc_cache and use_cache
+          return nil if !@cloud_id
           max_retries = 5
           retries = 0
           if !@cloud_id.nil?
@@ -1473,11 +900,12 @@ module MU
               if resp and resp.reservations and resp.reservations.first and
                  resp.reservations.first.instances and
                  resp.reservations.first.instances.first
-                return resp.reservations.first.instances.first
+                @cloud_desc_cache = resp.reservations.first.instances.first
+                return @cloud_desc_cache
               end
             rescue Aws::EC2::Errors::InvalidInstanceIDNotFound
               return nil
-            rescue NoMethodError => e
+            rescue NoMethodError
               if retries >= max_retries
                 raise MuError, "Couldn't get a cloud descriptor for #{@mu_name} (#{@cloud_id})"
               else
@@ -1495,23 +923,19 @@ module MU
         # bastion hosts that may be in the path, see getSSHConfig if that's what
         # you need.
         def canonicalIP
-          mu_name, config, deploydata = describe(cloud_id: @cloud_id)
-
-          instance = cloud_desc
-
-          if !instance
+          if !cloud_desc
             raise MuError, "Couldn't retrieve cloud descriptor for server #{self}"
           end
 
           if deploydata.nil? or
               (!deploydata.has_key?("private_ip_address") and
                   !deploydata.has_key?("public_ip_address"))
-            return nil if instance.nil?
+            return nil if cloud_desc.nil?
             @deploydata = {} if @deploydata.nil?
-            @deploydata["public_ip_address"] = instance.public_ip_address
-            @deploydata["public_dns_name"] = instance.public_dns_name
-            @deploydata["private_ip_address"] = instance.private_ip_address
-            @deploydata["private_dns_name"] = instance.private_dns_name
+            @deploydata["public_ip_address"] = cloud_desc.public_ip_address
+            @deploydata["public_dns_name"] = cloud_desc.public_dns_name
+            @deploydata["private_ip_address"] = cloud_desc.private_ip_address
+            @deploydata["private_dns_name"] = cloud_desc.private_dns_name
 
             notify
           end
@@ -1519,14 +943,14 @@ module MU
           # Our deploydata gets corrupted often with server pools, this will cause us to use the wrong IP to identify a node
           # which will cause us to create certificates, DNS records and other artifacts with incorrect information which will cause our deploy to fail.
           # The cloud_id is always correct so lets use 'cloud_desc' to get the correct IPs
-          if MU::Cloud::AWS::VPC.haveRouteToInstance?(cloud_desc, region: @config['region'], credentials: @config['credentials']) or @deploydata["public_ip_address"].nil?
-            @config['canonical_ip'] = instance.private_ip_address
-            @deploydata["private_ip_address"] = instance.private_ip_address
-            return instance.private_ip_address
+          if MU::Cloud.resourceClass("AWS", "VPC").haveRouteToInstance?(cloud_desc, region: @config['region'], credentials: @config['credentials']) or @deploydata["public_ip_address"].nil?
+            @config['canonical_ip'] = cloud_desc.private_ip_address
+            @deploydata["private_ip_address"] = cloud_desc.private_ip_address
+            return cloud_desc.private_ip_address
           else
-            @config['canonical_ip'] = instance.public_ip_address
-            @deploydata["public_ip_address"] = instance.public_ip_address
-            return instance.public_ip_address
+            @config['canonical_ip'] = cloud_desc.public_ip_address
+            @deploydata["public_ip_address"] = cloud_desc.public_ip_address
+            return cloud_desc.public_ip_address
           end
         end
 
@@ -1574,7 +998,7 @@ module MU
           resp = nil
           begin
             resp = MU::Cloud::AWS.ec2(region: region, credentials: credentials).create_image(ami_descriptor)
-          rescue Aws::EC2::Errors::InvalidAMINameDuplicate => e
+          rescue Aws::EC2::Errors::InvalidAMINameDuplicate
             MU.log "AMI #{name} already exists, skipping", MU::WARN
             return nil
           end
@@ -1583,7 +1007,7 @@ module MU
 
           ami_ids[region] = ami
           MU::Cloud::AWS.createStandardTags(ami, region: region, credentials: credentials)
-          MU::MommaCat.createTag(ami, "Name", name, region: region, credentials: credentials)
+          MU::Cloud::AWS.createTag(ami, "Name", name, region: region, credentials: credentials)
           MU.log "AMI of #{name} in region #{region}: #{ami}"
           if make_public
             MU::Cloud::AWS::Server.waitForAMI(ami, region: region, credentials: credentials)
@@ -1611,10 +1035,10 @@ module MU
                 ami_ids[r] = copy.image_id
 
                 MU::Cloud::AWS.createStandardTags(copy.image_id, region: r, credentials: credentials)
-                MU::MommaCat.createTag(copy.image_id, "Name", name, region: r, credentials: credentials)
+                MU::Cloud::AWS.createTag(copy.image_id, "Name", name, region: r, credentials: credentials)
                 if !tags.nil?
                   tags.each { |tag|
-                    MU::MommaCat.createTag(instance.instance_id, tag['key'], tag['value'], region: r, credentials: credentials)
+                    MU::Cloud::AWS.createTag(instance.instance_id, tag['key'], tag['value'], region: r, credentials: credentials)
                   }
                 end
                 MU::Cloud::AWS::Server.waitForAMI(copy.image_id, region: r, credentials: credentials)
@@ -1719,11 +1143,27 @@ module MU
         # Retrieves the Cloud provider's randomly generated Windows password
         # Will only work on stock Amazon Windows AMIs or custom AMIs that where created with Administrator Password set to random in EC2Config
         # return [String]: A password string.
-        def getWindowsAdminPassword
-          if @cloud_id.nil?
-            node, config, deploydata = describe
-            @cloud_id = cloud_desc.instance_id
+        def getWindowsAdminPassword(use_cache: true)
+          @config['windows_auth_vault'] ||= {
+            "vault" => @mu_name,
+            "item" => "windows_credentials",
+            "password_field" => "password"
+          }
+
+          if use_cache
+            begin
+              win_admin_password = @groomer.getSecret(
+                vault: @config['windows_auth_vault']['vault'],
+                item: @config['windows_auth_vault']['item'],
+                field: @config["windows_auth_vault"]["password_field"]
+              )
+
+              return win_admin_password if win_admin_password
+            rescue MU::Groomer::MuNoSuchSecret, MU::Groomer::RunError
+            end
           end
+
+          @cloud_id ||= cloud_desc(use_cache: false).instance_id
           ssh_keydir = "#{Etc.getpwuid(Process.uid).dir}/.ssh"
           ssh_key_name = @deploy.ssh_key_name
 
@@ -1758,6 +1198,8 @@ module MU
           pem_bytes = File.open("#{ssh_keydir}/#{ssh_key_name}", 'rb') { |f| f.read }
           private_key = OpenSSL::PKey::RSA.new(pem_bytes)
           decrypted_password = private_key.private_decrypt(decoded)
+          saveCredentials(decrypted_password)
+
           return decrypted_password
         end
 
@@ -1831,61 +1273,37 @@ module MU
         # @param type [String]: Cloud storage type of the volume, if applicable
         # @param delete_on_termination [Boolean]: Value of delete_on_termination flag to set
         def addVolume(dev, size, type: "gp2", delete_on_termination: false)
-          if @cloud_id.nil? or @cloud_id.empty?
-            MU.log "#{self} didn't have a cloud id, couldn't determine 'active?' status", MU::ERR
-            return true
+
+          if setDeleteOntermination(dev, delete_on_termination)
+            MU.log "A volume #{device} already attached to #{self}, skipping", MU::NOTICE
+            return
           end
-          az = nil
-          MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_instances(
-            instance_ids: [@cloud_id]
-          ).reservations.each { |resp|
-            if !resp.nil? and !resp.instances.nil?
-              resp.instances.each { |instance|
-                az = instance.placement.availability_zone
-                d_o_t_changed = true
-                mappings = MU.structToHash(instance.block_device_mappings)
-                mappings.each { |vol|
-                  if vol[:ebs]
-                    vol[:ebs].delete(:attach_time)
-                    vol[:ebs].delete(:status)
-                  end
-                }
-                mappings.each { |vol|
-                  if vol[:device_name] == dev
-                    MU.log "A volume #{dev} already attached to #{self}, skipping", MU::NOTICE
-                    if vol[:ebs][:delete_on_termination] != delete_on_termination
-                      vol[:ebs][:delete_on_termination] = delete_on_termination
-                      MU.log "Setting delete_on_termination flag to #{delete_on_termination.to_s} on #{@mu_name}'s #{dev}"
-                      MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).modify_instance_attribute(
-                        instance_id: @cloud_id,
-                        block_device_mappings: mappings
-                      )
-                    end
-                    return
-                  end
-                }
-              }
-            end
-          }
+
           MU.log "Creating #{size}GB #{type} volume on #{dev} for #{@cloud_id}"
           creation = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).create_volume(
-            availability_zone: az,
+            availability_zone: cloud_desc.placement.availability_zone,
             size: size,
             volume_type: type
           )
-          begin
-            sleep 3
+
+          MU.retrier(wait: 3, loop_if: Proc.new {
             creation = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_volumes(volume_ids: [creation.volume_id]).volumes.first
             if !["creating", "available"].include?(creation.state)
               raise MuError, "Saw state '#{creation.state}' while creating #{size}GB #{type} volume on #{dev} for #{@cloud_id}"
             end
-          end while creation.state != "available"
+            creation.state != "available"
+          })
+
 
           if @deploy
-            MU::MommaCat.listStandardTags.each_pair { |key, value|
-              MU::MommaCat.createTag(creation.volume_id, key, value, region: @config['region'], credentials: @config['credentials'])
-            }
-            MU::MommaCat.createTag(creation.volume_id, "Name", "#{MU.deploy_id}-#{@config["name"].upcase}-#{dev.upcase}", region: @config['region'], credentials: @config['credentials'])
+            MU::Cloud::AWS.createStandardTags(
+              creation.volume_id,
+              region: @config['region'],
+              credentials: @config['credentials'],
+              optional: @config['optional_tags'],
+              nametag: @mu_name+"-"+dev.upcase,
+              othertags: @config['tags']
+            )
           end
 
           attachment = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).attach_volume(
@@ -1904,29 +1322,7 @@ module MU
 
           # Set delete_on_termination, which for some reason is an instance
           # attribute and not on the attachment
-          mappings = MU.structToHash(cloud_desc.block_device_mappings)
-          changed = false
-
-          mappings.each { |mapping|
-            if mapping[:ebs]
-              mapping[:ebs].delete(:attach_time)
-              mapping[:ebs].delete(:status)
-            end
-            if mapping[:device_name] == dev and 
-               mapping[:ebs][:delete_on_termination] != delete_on_termination
-              changed = true
-              mapping[:ebs][:delete_on_termination] = delete_on_termination
-            end
-          }
-
-          if changed
-            MU.log "Setting delete_on_termination flag to #{delete_on_termination.to_s} on #{@mu_name}'s #{dev}"
-            MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).modify_instance_attribute(
-              instance_id: @cloud_id,
-              block_device_mappings: mappings
-            )
-          end
-
+          setDeleteOntermination(dev, delete_on_termination)
         end
 
         # Determine whether the node in question exists at the Cloud provider
@@ -1964,13 +1360,13 @@ module MU
         # @param ip [String]: Request a specific IP address.
         # @param region [String]: The cloud provider region
         # @return [void]
-        def self.associateElasticIp(instance_id, classic: false, ip: nil, region: MU.curRegion)
+        def self.associateElasticIp(instance_id, classic: false, ip: nil, region: MU.curRegion, credentials: nil)
           MU.log "associateElasticIp called: #{instance_id}, classic: #{classic}, ip: #{ip}, region: #{region}", MU::DEBUG
           elastic_ip = nil
           @eip_semaphore.synchronize {
             if !ip.nil?
               filters = [{name: "public-ip", values: [ip]}]
-              resp = MU::Cloud::AWS.ec2(region: region).describe_addresses(filters: filters)
+              resp = MU::Cloud::AWS.ec2(region: region, credentials: credentials).describe_addresses(filters: filters)
               if @eips_used.include?(ip)
                 is_free = false
                 resp.addresses.each { |address|
@@ -1999,54 +1395,44 @@ module MU
             @eips_used << elastic_ip.public_ip
             MU.log "Associating Elastic IP #{elastic_ip.public_ip} with #{instance_id}", details: elastic_ip
           }
-          attempts = 0
-          begin
+
+          on_retry = Proc.new { |e|
+            if e.class == Aws::EC2::Errors::ResourceAlreadyAssociated
+              # A previous association attempt may have succeeded, albeit slowly.
+              resp = MU::Cloud::AWS.ec2(region: region, credentials: credentials).describe_addresses(
+                allocation_ids: [elastic_ip.allocation_id]
+              )
+              first_addr = resp.addresses.first
+              if first_addr and first_addr.instance_id != instance_id
+                raise MuError, "Tried to associate #{elastic_ip.public_ip} with #{instance_id}, but it's already associated with #{first_addr.instance_id}!"
+              end
+            end
+          }
+
+          MU.retrier([Aws::EC2::Errors::IncorrectInstanceState, Aws::EC2::Errors::ResourceAlreadyAssociated], wait: 5, max: 6, on_retry: on_retry) {
             if classic
-              resp = MU::Cloud::AWS.ec2(region: region).associate_address(
-                  instance_id: instance_id,
-                  public_ip: elastic_ip.public_ip
+              MU::Cloud::AWS.ec2(region: region, credentials: credentials).associate_address(
+                instance_id: instance_id,
+                public_ip: elastic_ip.public_ip
               )
             else
-              resp = MU::Cloud::AWS.ec2(region: region).associate_address(
-                  instance_id: instance_id,
-                  allocation_id: elastic_ip.allocation_id,
-                  allow_reassociation: false
+              MU::Cloud::AWS.ec2(region: region, credentials: credentials).associate_address(
+                instance_id: instance_id,
+                allocation_id: elastic_ip.allocation_id,
+                allow_reassociation: false
               )
             end
-          rescue Aws::EC2::Errors::IncorrectInstanceState => e
-            attempts = attempts + 1
-            if attempts < 6
-              MU.log "Got #{e.message} associating #{elastic_ip.allocation_id} with #{instance_id}, retrying", MU::WARN
-              sleep 5
-              retry
-            end
-            raise MuError "#{e.message} associating #{elastic_ip.allocation_id} with #{instance_id}"
-          rescue Aws::EC2::Errors::ResourceAlreadyAssociated => e
-            # A previous association attempt may have succeeded, albeit slowly.
-            resp = MU::Cloud::AWS.ec2(region: region).describe_addresses(
-                allocation_ids: [elastic_ip.allocation_id]
-            )
-            first_addr = resp.addresses.first
-            if !first_addr.nil? and first_addr.instance_id == instance_id
-              MU.log "#{elastic_ip.public_ip} already associated with #{instance_id}", MU::WARN
-            else
-              MU.log "#{elastic_ip.public_ip} shows as already associated!", MU::ERR, details: resp
-              raise MuError, "#{elastic_ip.public_ip} shows as already associated with #{first_addr.instance_id}!"
-            end
-          end
+          }
 
-          instance = MU::Cloud::AWS.ec2(region: region).describe_instances(instance_ids: [instance_id]).reservations.first.instances.first
-          waited = false
-          if instance.public_ip_address != elastic_ip.public_ip
-            waited = true
-            begin
-              sleep 10
-              MU.log "Waiting for Elastic IP association of #{elastic_ip.public_ip} to #{instance_id} to take effect", MU::NOTICE
-              instance = MU::Cloud::AWS.ec2(region: region).describe_instances(instance_ids: [instance_id]).reservations.first.instances.first
-            end while instance.public_ip_address != elastic_ip.public_ip
-          end
+          loop_if = Proc.new {
+            instance = find(cloud_id: instance_id, region: region, credentials: credentials).values.first
+            instance.public_ip_address != elastic_ip.public_ip
+          }
+          MU.retrier(loop_if: loop_if, wait: 10, max: 3) {
+            MU.log "Waiting for Elastic IP association of #{elastic_ip.public_ip} to #{instance_id} to take effect", MU::NOTICE
+          }
 
-          MU.log "Elastic IP #{elastic_ip.public_ip} now associated with #{instance_id}" if waited
+          MU.log "Elastic IP #{elastic_ip.public_ip} now associated with #{instance_id}"
 
           return elastic_ip.public_ip
         end
@@ -2069,16 +1455,15 @@ module MU
         # @param ignoremaster [Boolean]: If true, will remove resources not flagged as originating from this Mu server
         # @param region [String]: The cloud provider region
         # @return [void]
-        def self.cleanup(noop: false, ignoremaster: false, region: MU.curRegion, credentials: nil, flags: {})
+        def self.cleanup(noop: false, deploy_id: MU.deploy_id, ignoremaster: false, region: MU.curRegion, credentials: nil, flags: {})
           onlycloud = flags["onlycloud"]
           skipsnapshots = flags["skipsnapshots"]
           tagfilters = [
-            {name: "tag:MU-ID", values: [MU.deploy_id]}
+            {name: "tag:MU-ID", values: [deploy_id]}
           ]
           if !ignoremaster
             tagfilters << {name: "tag:MU-MASTER-IP", values: [MU.mu_public_ip]}
           end
-          instances = Array.new
           unterminated = Array.new
           name_tags = Array.new
 
@@ -2108,7 +1493,7 @@ module MU
             threads << Thread.new(instance) { |myinstance|
               MU.dupGlobals(parent_thread_id)
               Thread.abort_on_exception = true
-              MU::Cloud::AWS::Server.terminateInstance(id: myinstance.instance_id, noop: noop, onlycloud: onlycloud, region: region, deploy_id: MU.deploy_id, credentials: credentials)
+              MU::Cloud::AWS::Server.terminateInstance(id: myinstance.instance_id, noop: noop, onlycloud: onlycloud, region: region, deploy_id: deploy_id, credentials: credentials)
             }
           }
 
@@ -2119,7 +1504,7 @@ module MU
             threads << Thread.new(volume) { |myvolume|
               MU.dupGlobals(parent_thread_id)
               Thread.abort_on_exception = true
-              MU::Cloud::AWS::Server.delete_volume(myvolume, noop, skipsnapshots, credentials: credentials)
+              delete_volume(myvolume, noop, skipsnapshots, credentials: credentials, deploy_id: deploy_id)
             }
           }
 
@@ -2129,193 +1514,113 @@ module MU
           }
         end
 
+        # Return an instance's AWS-assigned IP addresses and hostnames.
+        # @param instance [OpenStruct]
+        # @param id [String]
+        # @param region [String]
+        # @param credentials [@String]
+        # @return [Array<Array>]
+        def self.getAddresses(instance = nil, id: nil, region: MU.curRegion, credentials: nil)
+          return nil if !instance and !id
+
+          instance ||= find(cloud_id: id, region: region, credentials: credentials).values.first
+          return if !instance
+
+          ips = []
+          names = []
+          instance.network_interfaces.each { |iface|
+            iface.private_ip_addresses.each { |ip|
+              ips << ip.private_ip_address
+              names << ip.private_dns_name
+              if ip.association
+                ips << ip.association.public_ip
+                names << ip.association.public_dns_name
+              end
+            }
+          }
+
+          [ips, names]
+        end
+
         # Terminate an instance.
         # @param instance [OpenStruct]: The cloud provider's description of the instance.
         # @param id [String]: The cloud provider's identifier for the instance, to use if the full description is not available.
         # @param region [String]: The cloud provider region
         # @return [void]
         def self.terminateInstance(instance: nil, noop: false, id: nil, onlycloud: false, region: MU.curRegion, deploy_id: MU.deploy_id, mu_name: nil, credentials: nil)
-          ips = Array.new
-          if !instance
-            if id
-              begin
-                resp = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_instances(instance_ids: [id])
-              rescue Aws::EC2::Errors::InvalidInstanceIDNotFound => e
-                MU.log "Instance #{id} no longer exists", MU::WARN
-              end
-              if !resp.nil? and !resp.reservations.nil? and !resp.reservations.first.nil?
-                instance = resp.reservations.first.instances.first
-                ips << instance.public_ip_address if !instance.public_ip_address.nil?
-                ips << instance.private_ip_address if !instance.private_ip_address.nil?
-              end
-            else
-              MU.log "You must supply an instance handle or id to terminateInstance", MU::ERR
-            end
-          else
-            id = instance.instance_id
-          end
-          if !MU.deploy_id.empty?
-            deploy_dir = File.expand_path("#{MU.dataDir}/deployments/"+MU.deploy_id)
-            if Dir.exist?(deploy_dir) and !noop
-              FileUtils.touch("#{deploy_dir}/.cleanup-"+id)
-            end
+          if !id and !instance
+            MU.log "You must supply an instance handle or id to terminateInstance", MU::ERR
+            return
           end
+          instance ||= find(cloud_id: id, region: region, credentials: credentials).values.first
+          return if !instance
 
-          server_obj = MU::MommaCat.findStray(
-              "AWS",
-              "servers",
-              region: region,
-              deploy_id: deploy_id,
-              cloud_id: id,
-              mu_name: mu_name
-          ).first
-
+          id ||= instance.instance_id
           begin
-            MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_instances(instance_ids: [id])
-          rescue Aws::EC2::Errors::InvalidInstanceIDNotFound => e
-            MU.log "Instance #{id} no longer exists", MU::DEBUG
-          end
-
-          if !server_obj.nil? and MU::Cloud::AWS.hosted? and !MU::Cloud::AWS.isGovCloud?
-            # DNS cleanup is now done in MU::Cloud::DNSZone. Keeping this for now
-            cleaned_dns = false
-            mu_name = server_obj.mu_name
-            mu_zone = MU::Cloud::DNSZone.find(cloud_id: "platform-mu", credentials: credentials).values.first
-            if !mu_zone.nil?
-              zone_rrsets = []
-              rrsets = MU::Cloud::AWS.route53(credentials: credentials).list_resource_record_sets(hosted_zone_id: mu_zone.id)
-              rrsets.resource_record_sets.each{ |record|
-                zone_rrsets << record
-              }
+            MU::MommaCat.lock(".cleanup-"+id)
+          rescue Errno::ENOENT => e
+            MU.log "No lock for terminating instance #{id} due to missing metadata", MU::DEBUG
+          end
 
-            # AWS API returns a maximum of 100 results. DNS zones are likely to have more than 100 records, lets page and make sure we grab all records in a given zone
-              while rrsets.next_record_name && rrsets.next_record_type
-                rrsets = MU::Cloud::AWS.route53(credentials: credentials).list_resource_record_sets(hosted_zone_id: mu_zone.id, start_record_name: rrsets.next_record_name, start_record_type: rrsets.next_record_type)
-                rrsets.resource_record_sets.each{ |record|
-                  zone_rrsets << record
-                }
-              end
-            end
-            if !onlycloud and !mu_name.nil?
-              # DNS cleanup is now done in MU::Cloud::DNSZone. Keeping this for now
-              if !zone_rrsets.nil? and !zone_rrsets.empty?
-                zone_rrsets.each { |rrset|
-                  if rrset.name.match(/^#{mu_name.downcase}\.server\.#{MU.myInstanceId}\.platform-mu/i)
-                    rrset.resource_records.each { |record|
-                      MU::Cloud::DNSZone.genericMuDNSEntry(name: mu_name, target: record.value, cloudclass: MU::Cloud::Server, delete: true)
-                      cleaned_dns = true
-                    }
-                  end
-                }
-              end
+          ips, names = getAddresses(instance, region: region, credentials: credentials)
+          targets = ips +names
 
-							if !noop
-                if !server_obj.nil? and !server_obj.config.nil?
-			            MU.mommacat.notify(MU::Cloud::Server.cfg_plural, server_obj.config['name'], {}, mu_name: server_obj.mu_name, remove: true) if MU.mommacat
-								end
-							end
+          server_obj = MU::MommaCat.findStray(
+            "AWS",
+            "servers",
+            region: region,
+            deploy_id: deploy_id,
+            cloud_id: id,
+            mu_name: mu_name,
+            dummy_ok: true
+          ).first
 
-              # If we didn't manage to find this instance's Route53 entry by sifting
-              # deployment metadata, see if we can get it with the Name tag.
-              if !mu_zone.nil? and !cleaned_dns and !instance.nil?
-                instance.tags.each { |tag|
-                  if tag.key == "Name"
-                    zone_rrsets.each { |rrset|
-                      if rrset.name.match(/^#{tag.value.downcase}\.server\.#{MU.myInstanceId}\.platform-mu/i)
-                        rrset.resource_records.each { |record|
-                          MU::Cloud::DNSZone.genericMuDNSEntry(name: tag.value, target: record.value, cloudclass: MU::Cloud::Server, delete: true) if !noop
-                        }
-                      end
-                    }
-                  end
-                }
-              end
-            end
+          if MU::Cloud::AWS.hosted? and !MU::Cloud::AWS.isGovCloud? and server_obj
+            targets.each { |target|
+              MU::Cloud::DNSZone.genericMuDNSEntry(name: server_obj.mu_name, target: target, cloudclass: MU::Cloud::Server, delete: true, noop: noop)
+            }
           end
 
-          if ips.size > 0 and !onlycloud
-            known_hosts_files = [Etc.getpwuid(Process.uid).dir+"/.ssh/known_hosts"]
-            if Etc.getpwuid(Process.uid).name == "root" and !MU.inGem?
-              begin
-                known_hosts_files << Etc.getpwnam("nagios").dir+"/.ssh/known_hosts"
-              rescue ArgumentError
-                # we're in a non-nagios environment and that's ok
-              end
-            end
-            known_hosts_files.each { |known_hosts|
-              next if !File.exist?(known_hosts)
-              MU.log "Cleaning up #{ips} from #{known_hosts}"
-              if !noop
-                File.open(known_hosts, File::CREAT|File::RDWR, 0644) { |f|
-                  f.flock(File::LOCK_EX)
-                  newlines = Array.new
-                  f.readlines.each { |line|
-                    ip_match = false
-                    ips.each { |ip|
-                      if line.match(/(^|,| )#{ip}( |,)/)
-                        MU.log "Expunging #{ip} from #{known_hosts}"
-                        ip_match = true
-                      end
-                    }
-                    newlines << line if !ip_match
-                  }
-                  f.rewind
-                  f.truncate(0)
-                  f.puts(newlines)
-                  f.flush
-                  f.flock(File::LOCK_UN)
-                }
-              end
+          if targets.size > 0 and !onlycloud
+            MU::Master.removeInstanceFromEtcHosts(server_obj.mu_name) if !noop and server_obj
+            targets.each { |target|
+              next if !target.match(/^\d+\.\d+\.\d+\.\d+$/)
+              MU::Master.removeIPFromSSHKnownHosts(target, noop: noop)
             }
           end
 
-          return if instance.nil?
+          on_retry = Proc.new {
+            instance = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_instances(instance_ids: [instance.instance_id]).reservations.first.instances.first
+            if instance.state.name == "terminated"
+              MU.log "#{instance.instance_id}#{server_obj ? " ("+server_obj.mu_name+")" : ""} has already been terminated, skipping"
+              MU::MommaCat.unlock(".cleanup-"+id)
+              return
+            end
+          }
 
-          name = ""
-          instance.tags.each { |tag|
-            name = tag.value if tag.key == "Name"
+          loop_if = Proc.new {
+            instance = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_instances(instance_ids: [instance.instance_id]).reservations.first.instances.first
+            instance.state.name != "terminated"
           }
 
-          if instance.state.name == "terminated"
-            MU.log "#{instance.instance_id} (#{name}) has already been terminated, skipping"
-          else
-            if instance.state.name == "terminating"
-              MU.log "#{instance.instance_id} (#{name}) already terminating, waiting"
-            elsif instance.state.name != "running" and instance.state.name != "pending" and instance.state.name != "stopping" and instance.state.name != "stopped"
-              MU.log "#{instance.instance_id} (#{name}) is in state #{instance.state.name}, waiting"
-            else
-              MU.log "Terminating #{instance.instance_id} (#{name}) #{noop}"
-              if !noop
-                begin
-                  MU::Cloud::AWS.ec2(credentials: credentials, region: region).modify_instance_attribute(
-                      instance_id: instance.instance_id,
-                      disable_api_termination: {value: false}
-                  )
-                  MU::Cloud::AWS.ec2(credentials: credentials, region: region).terminate_instances(instance_ids: [instance.instance_id])
-                    # Small race window here with the state changing from under us
-                rescue Aws::EC2::Errors::IncorrectInstanceState => e
-                  resp = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_instances(instance_ids: [id])
-                  if !resp.nil? and !resp.reservations.nil? and !resp.reservations.first.nil?
-                    instance = resp.reservations.first.instances.first
-                    if !instance.nil? and instance.state.name != "terminated" and instance.state.name != "terminating"
-                      sleep 5
-                      retry
-                    end
-                  end
-                rescue Aws::EC2::Errors::InternalError => e
-                  MU.log "Error #{e.inspect} while Terminating instance #{instance.instance_id} (#{name}), retrying", MU::WARN, details: e.inspect
-                  sleep 5
-                  retry
-                end
-              end
-            end
-            while instance.state.name != "terminated" and !noop
-              sleep 30
-              instance_response = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_instances(instance_ids: [instance.instance_id])
-              instance = instance_response.reservations.first.instances.first
-            end
-            MU.log "#{instance.instance_id} (#{name}) terminated" if !noop
+          MU.log "Terminating #{instance.instance_id}#{server_obj ? " ("+server_obj.mu_name+")" : ""}"
+          if !noop
+            MU.retrier([Aws::EC2::Errors::IncorrectInstanceState, Aws::EC2::Errors::InternalError], wait: 30, max: 60, loop_if: loop_if, on_retry: on_retry) {
+              MU::Cloud::AWS.ec2(credentials: credentials, region: region).modify_instance_attribute(
+                instance_id: instance.instance_id,
+                disable_api_termination: {value: false}
+              )
+              MU::Cloud::AWS.ec2(credentials: credentials, region: region).terminate_instances(instance_ids: [instance.instance_id])
+            }
           end
+
+          MU.log "#{instance.instance_id}#{server_obj ? " ("+server_obj.mu_name+")" : ""} terminated" if !noop
+          begin
+            MU::MommaCat.unlock(".cleanup-"+id)
+          rescue Errno::ENOENT => e
+            MU.log "No lock for terminating instance #{id} due to missing metadata", MU::DEBUG
+          end
+
         end
 
         # Return a BoK-style config hash describing a NAT instance. We use this
@@ -2336,15 +1641,19 @@ module MU
         end
 
         # Cloud-specific configuration properties.
-        # @param config [MU::Config]: The calling MU::Config object
+        # @param _config [MU::Config]: The calling MU::Config object
         # @return [Array<Array,Hash>]: List of required fields, and json-schema Hash of cloud-specific configuration parameters for this resource
-        def self.schema(config)
+        def self.schema(_config)
           toplevel_required = []
           schema = {
             "ami_id" => {
               "type" => "string",
               "description" => "Alias for +image_id+"
             },
+            "windows_admin_username" => {
+              "type" => "string",
+              "default" => "Administrator"
+            },
             "generate_iam_role" => {
               "type" => "boolean",
               "default" => true,
@@ -2368,25 +1677,47 @@ module MU
                 "type" => "object"
               }
             },
-            "ingress_rules" => {
-              "items" => {
-                "properties" => {
-                  "sgs" => {
-                    "type" => "array",
-                    "items" => {
-                      "description" => "Other AWS Security Groups; resources that are associated with this group will have this rule applied to their traffic",
-                      "type" => "string"
-                    }
-                  },
-                  "lbs" => {
-                    "type" => "array",
-                    "items" => {
-                      "description" => "AWS Load Balancers which will have this rule applied to their traffic",
-                      "type" => "string"
-                    }
-                  }
+            "ingress_rules" => MU::Cloud.resourceClass("AWS", "FirewallRule").ingressRuleAddtlSchema,
+            "ssh_user" => {
+              "type" => "string",
+              "default" => "root",
+              "default_if" => [
+                {
+                  "key_is" => "platform",
+                  "value_is" => "windows",
+                  "set" => "Administrator"
+                },
+                {
+                  "key_is" => "platform",
+                  "value_is" => "win2k12",
+                  "set" => "Administrator"
+                },
+                {
+                  "key_is" => "platform",
+                  "value_is" => "win2k12r2",
+                  "set" => "Administrator"
+                },
+                {
+                  "key_is" => "platform",
+                  "value_is" => "win2k16",
+                  "set" => "Administrator"
+                },
+                {
+                  "key_is" => "platform",
+                  "value_is" => "rhel7",
+                  "set" => "ec2-user"
+                },
+                {
+                  "key_is" => "platform",
+                  "value_is" => "rhel71",
+                  "set" => "ec2-user"
+                },
+                {
+                  "key_is" => "platform",
+                  "value_is" => "amazon",
+                  "set" => "ec2-user"
                 }
-              }
+              ]
             }
           }
           [toplevel_required, schema]
@@ -2414,8 +1745,7 @@ module MU
 
             MU::Cloud.availableClouds.each { |cloud|
               next if cloud == "AWS"
-              cloudbase = Object.const_get("MU").const_get("Cloud").const_get(cloud)
-              foreign_types = (cloudbase.listInstanceTypes).values.first
+              foreign_types = (MU::Cloud.cloudClass(cloud).listInstanceTypes).values.first
               if foreign_types.size == 1
                 foreign_types = foreign_types.values.first
               end
@@ -2446,6 +1776,45 @@ module MU
           size
         end
 
+        # Boilerplate generation of an instance role
+        # @param server [Hash]: The BoK-style config hash for a +Server+ or +ServerPool+
+        # @param configurator [MU::Config]
+        def self.generateStandardRole(server, configurator)
+          role = {
+            "name" => server["name"],
+            "credentials" => server["credentials"],
+            "can_assume" => [
+              {
+                "entity_id" => "ec2.amazonaws.com",
+                "entity_type" => "service"
+              }
+            ],
+            "policies" => [
+              {
+                "name" => "MuSecrets",
+                "permissions" => ["s3:GetObject"],
+                "targets" => [
+                  {
+                    "identifier" => 'arn:'+(MU::Cloud::AWS.isGovCloud?(server['region']) ? "aws-us-gov" : "aws")+':s3:::'+MU::Cloud::AWS.adminBucketName(server['credentials'])+'/Mu_CA.pem'
+                  }
+                ]
+              }
+            ]
+          }
+          if server['iam_policies']
+            role['iam_policies'] = server['iam_policies'].dup
+          end
+          if server['canned_iam_policies']
+            role['import'] = server['canned_iam_policies'].dup
+          end
+          if server['iam_role']
+# XXX maybe break this down into policies and add those?
+          end
+
+          configurator.insertKitten(role, "roles")
+          MU::Config.addDependency(server, server["name"], "role")
+        end
+
         # Cloud-specific pre-processing of {MU::Config::BasketofKittens::servers}, bare and unvalidated.
         # @param server [Hash]: The resource to process and validate
         # @param configurator [MU::Config]: The overall deployment configurator of which this resource is a member
@@ -2466,43 +1835,7 @@ module MU
               ok = false
             end
           else
-            role = {
-              "name" => server["name"],
-              "credentials" => server["credentials"],
-              "can_assume" => [
-                {
-                  "entity_id" => "ec2.amazonaws.com",
-                  "entity_type" => "service"
-                }
-              ],
-              "policies" => [
-                {
-                  "name" => "MuSecrets",
-                  "permissions" => ["s3:GetObject"],
-                  "targets" => [
-                    {
-                      "identifier" => 'arn:'+(MU::Cloud::AWS.isGovCloud?(server['region']) ? "aws-us-gov" : "aws")+':s3:::'+MU::Cloud::AWS.adminBucketName(server['credentials'])+'/Mu_CA.pem'
-                    }
-                  ]
-                }
-              ]
-            }
-            if server['iam_policies']
-              role['iam_policies'] = server['iam_policies'].dup
-            end
-            if server['canned_iam_policies']
-              role['import'] = server['canned_iam_policies'].dup
-            end
-            if server['iam_role']
-# XXX maybe break this down into policies and add those?
-            end
-
-            configurator.insertKitten(role, "roles")
-            server["dependencies"] ||= []
-            server["dependencies"] << {
-              "type" => "role",
-              "name" => server["name"]
-            }
+            generateStandardRole(server, configurator)
           end
           if !server['create_image'].nil?
             if server['create_image'].has_key?('copy_to_regions') and
@@ -2514,12 +1847,12 @@ module MU
             end
           end
 
-          server['ami_id'] ||= server['image_id']
+          server['image_id'] ||= server['ami_id']
 
-          if server['ami_id'].nil?
+          if server['image_id'].nil?
             img_id = MU::Cloud.getStockImage("AWS", platform: server['platform'], region: server['region'])
             if img_id
-              server['ami_id'] = configurator.getTail("server"+server['name']+"AMI", value: img_id, prettyname: "server"+server['name']+"AMI", cloudtype: "AWS::EC2::Image::Id")
+              server['image_id'] = configurator.getTail("server"+server['name']+"AMI", value: img_id, prettyname: "server"+server['name']+"AMI", cloudtype: "AWS::EC2::Image::Id")
             else
               MU.log "No AMI specified for #{server['name']} and no default available for platform #{server['platform']} in region #{server['region']}", MU::ERR, details: server
               ok = false
@@ -2528,22 +1861,13 @@ module MU
 
           if !server["loadbalancers"].nil?
             server["loadbalancers"].each { |lb|
-              if lb["concurrent_load_balancer"] != nil
-                server["dependencies"] << {
-                    "type" => "loadbalancer",
-                    "name" => lb["concurrent_load_balancer"]
-                }
+              lb["name"] ||= lb["concurrent_load_balancer"]
+              if lb["name"]
+                MU::Config.addDependency(server, lb["name"], "loadbalancer")
               end
             }
           end
 
-          if !server["vpc"].nil?
-            if server["vpc"]["subnet_name"].nil? and server["vpc"]["subnet_id"].nil? and server["vpc"]["subnet_pref"].nil?
-              MU.log "A server VPC block must specify a target subnet", MU::ERR
-              ok = false
-            end
-          end
-
           ok
         end
 
@@ -2556,36 +1880,34 @@ module MU
             img = MU::Cloud::AWS.ec2(region: region, credentials: credentials).describe_images(image_ids: [ami_id]).images.first
             return DateTime.new if img.nil?
             return DateTime.parse(img.creation_date)
-          rescue Aws::EC2::Errors::InvalidAMIIDNotFound => e
+          rescue Aws::EC2::Errors::InvalidAMIIDNotFound
           end
 
           return DateTime.new
         end
 
-        private
-
         # Destroy a volume.
         # @param volume [OpenStruct]: The cloud provider's description of the volume.
-        # @param id [String]: The cloud provider's identifier for the volume, to use if the full description is not available.
         # @param region [String]: The cloud provider region
         # @return [void]
-        def self.delete_volume(volume, noop, skipsnapshots, id: nil, region: MU.curRegion, credentials: nil)
+        def self.delete_volume(volume, noop, skipsnapshots, region: MU.curRegion, credentials: nil, deploy_id: MU.deploy_id)
           if !volume.nil?
             resp = MU::Cloud::AWS.ec2(region: region, credentials: credentials).describe_volumes(volume_ids: [volume.volume_id])
             volume = resp.data.volumes.first
           end
-          name = ""
+          name = nil
           volume.tags.each { |tag|
             name = tag.value if tag.key == "Name"
           }
+          name ||= volume.volume_id
 
           MU.log("Deleting volume #{volume.volume_id} (#{name})")
           if !noop
             if !skipsnapshots
               if !name.nil? and !name.empty?
-                desc = "#{MU.deploy_id}-MUfinal (#{name})"
+                desc = "#{deploy_id}-MUfinal (#{name})"
               else
-                desc = "#{MU.deploy_id}-MUfinal"
+                desc = "#{deploy_id}-MUfinal"
               end
 
               begin
@@ -2600,31 +1922,414 @@ module MU
               end
             end
 
-            retries = 0
             begin
-              MU::Cloud::AWS.ec2(region: region, credentials: credentials).delete_volume(volume_id: volume.volume_id)
-            rescue Aws::EC2::Errors::IncorrectState => e
-              MU.log "Volume #{volume.volume_id} (#{name}) in incorrect state (#{e.message}), will retry", MU::WARN
-              sleep 30
-              retry
-            rescue Aws::EC2::Errors::InvalidVolumeNotFound
-              MU.log "Volume #{volume.volume_id} (#{name}) disappeared before I could remove it!", MU::WARN
+              MU.retrier([Aws::EC2::Errors::IncorrectState, Aws::EC2::Errors::VolumeInUse], ignoreme: [Aws::EC2::Errors::InvalidVolumeNotFound], wait: 30, max: 10){
+                MU::Cloud::AWS.ec2(region: region, credentials: credentials).delete_volume(volume_id: volume.volume_id)
+              }
             rescue Aws::EC2::Errors::VolumeInUse
-              if retries < 10
-                volume.attachments.each { |attachment|
-                  MU.log "#{volume.volume_id} is attached to #{attachment.instance_id} as #{attachment.device}", MU::NOTICE
-                }
-                MU.log "Volume '#{name}' is still attached, waiting...", MU::NOTICE
-                sleep 30
-                retries = retries + 1
-                retry
+              MU.log "Failed to delete #{name}", MU::ERR
+            end
+
+          end
+        end
+        private_class_method :delete_volume
+
+        # Given some combination of a base image, BoK-configured storage, and
+        # ephemeral devices, return the structure passed to EC2 to declare
+        # block devicde mappings.
+        # @param image_id [String]
+        # @param storage [Array]
+        # @param add_ephemeral [Boolean]
+        # @param region [String]
+        # @param credentials [String]
+        def self.configureBlockDevices(image_id: nil, storage: nil, add_ephemeral: true, region: MU.myRegion, credentials: nil)
+          ext_disks = {}
+  
+          # Figure out which devices are embedded in the AMI already.
+          if image_id
+            image = MU::Cloud::AWS.ec2(region: region, credentials: credentials).describe_images(image_ids: [image_id]).images.first
+            if !image.block_device_mappings.nil?
+              image.block_device_mappings.each { |disk|
+                if !disk.device_name.nil? and !disk.device_name.empty? and !disk.ebs.nil? and !disk.ebs.empty?
+                  ext_disks[disk.device_name] = MU.structToHash(disk.ebs)
+                end
+              }
+            end
+          end
+  
+          configured_storage = []
+          if storage
+            storage.each { |vol|
+              # Drop the "encrypted" flag if a snapshot for this device exists
+              # in the AMI, even if they both agree about the value of said
+              # flag. Apparently that's a thing now.
+              if ext_disks.has_key?(vol["device"])
+                if ext_disks[vol["device"]].has_key?(:snapshot_id)
+                  vol.delete("encrypted")
+                end
+              end
+              mapping, _cfm_mapping = MU::Cloud::AWS::Server.convertBlockDeviceMapping(vol)
+              configured_storage << mapping
+            }
+          end
+  
+          configured_storage.concat(@ephemeral_mappings) if add_ephemeral
+  
+          configured_storage
+        end
+
+        # Return all of the IP addresses, public and private, from all of our
+        # network interfaces.
+        # @return [Array<String>]
+        def listIPs
+          MU::Cloud::AWS::Server.getAddresses(cloud_desc).first
+        end
+
+        private
+
+        def bootstrapGroomer
+          if (@config['groom'].nil? or @config['groom']) and !@groomer.haveBootstrapped?
+            MU.retrier([BootstrapTempFail], wait: 45) {
+              if windows? 
+                # kick off certificate generation early; WinRM will need it
+                @deploy.nodeSSLCerts(self)
+                @deploy.nodeSSLCerts(self, true) if @config.has_key?("basis")
+                session = getWinRMSession(50, 60, reboot_on_problems: true)
+                initialWinRMTasks(session)
+                begin
+                  session.close
+                rescue StandardError
+                  # session.close is allowed to fail- we're probably rebooting
+                end
+              else
+                session = getSSHSession(40, 30)
+                initialSSHTasks(session)
+              end
+            }
+          end
+
+          # See if this node already exists in our config management. If it
+          # does, we're done.
+
+          if MU.inGem?
+            MU.log "Deploying from a gem, not grooming"
+          elsif @config['groom'].nil? or @config['groom']
+            if @groomer.haveBootstrapped?
+              MU.log "Node #{@mu_name} has already been bootstrapped, skipping groomer setup.", MU::NOTICE
+            else
+              begin
+                @groomer.bootstrap
+              rescue MU::Groomer::RunError
+                return false
+              end
+            end
+            @groomer.saveDeployData
+          end
+
+          true
+        end
+
+        def saveCredentials(win_admin_password = nil)
+          ec2config_password = nil
+          sshd_password = nil
+          if windows?
+            if @config['use_cloud_provider_windows_password']
+              win_admin_password ||= getWindowsAdminPassword
+            elsif @config['windows_auth_vault'] and !@config['windows_auth_vault'].empty?
+              if @config["windows_auth_vault"].has_key?("password_field")
+                win_admin_password ||= @groomer.getSecret(
+                  vault: @config['windows_auth_vault']['vault'],
+                  item: @config['windows_auth_vault']['item'],
+                  field: @config["windows_auth_vault"]["password_field"]
+                )
               else
-                MU.log "Failed to delete #{name}", MU::ERR
+                win_admin_password ||= getWindowsAdminPassword
+              end
+
+              if @config["windows_auth_vault"].has_key?("ec2config_password_field")
+                ec2config_password = @groomer.getSecret(
+                  vault: @config['windows_auth_vault']['vault'],
+                  item: @config['windows_auth_vault']['item'],
+                  field: @config["windows_auth_vault"]["ec2config_password_field"]
+                )
+              end
+
+              if @config["windows_auth_vault"].has_key?("sshd_password_field")
+                sshd_password = @groomer.getSecret(
+                  vault: @config['windows_auth_vault']['vault'],
+                  item: @config['windows_auth_vault']['item'],
+                  field: @config["windows_auth_vault"]["sshd_password_field"]
+                )
+              end
+            end
+
+            win_admin_password ||= MU.generateWindowsPassword
+            ec2config_password ||= MU.generateWindowsPassword
+            sshd_password ||= MU.generateWindowsPassword
+
+            # We're creating the vault here so when we run
+            # MU::Cloud::Server.initialSSHTasks and we need to set the Windows
+            # Admin password we can grab it from said vault.
+            creds = {
+              "username" => @config['windows_admin_username'],
+              "password" => win_admin_password,
+              "ec2config_username" => "ec2config",
+              "ec2config_password" => ec2config_password,
+              "sshd_username" => "sshd_service",
+              "sshd_password" => sshd_password
+            }
+            @groomer.saveSecret(vault: @mu_name, item: "windows_credentials", data: creds, permissions: "name:#{@mu_name}")
+          end
+        end
+
+        def haveElasticIP?
+          if !cloud_desc.public_ip_address.nil?
+            begin
+              resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_addresses(public_ips: [cloud_desc.public_ip_address])
+              if resp.addresses.size > 0 and resp.addresses.first.instance_id == @cloud_id
+                return true
               end
+            rescue Aws::EC2::Errors::InvalidAddressNotFound
+              # XXX this is ok to ignore, it means the public IP isn't Elastic
             end
           end
+
+          false
         end
 
+        def configureNetworking
+          if !@config['static_ip'].nil?
+            if !@config['static_ip']['ip'].nil?
+              MU::Cloud::AWS::Server.associateElasticIp(@cloud_id, classic: @vpc.nil?, ip: @config['static_ip']['ip'])
+            elsif !haveElasticIP?
+              MU::Cloud::AWS::Server.associateElasticIp(@cloud_id, classic: @vpc.nil?)
+            end
+          end
+
+          if !@vpc.nil? and @config.has_key?("vpc")
+            subnet = @vpc.getSubnet(cloud_id: cloud_desc.subnet_id)
+
+            _nat_ssh_key, _nat_ssh_user, nat_ssh_host, _canonical_ip, _ssh_user, _ssh_key_name = getSSHConfig
+            if subnet.private? and !nat_ssh_host and !MU::Cloud.resourceClass("AWS", "VPC").haveRouteToInstance?(cloud_desc, region: @config['region'], credentials: @config['credentials'])
+              raise MuError, "#{@mu_name} is in a private subnet (#{subnet}), but has no bastion host configured, and I have no other route to it"
+            end
+
+            # If we've asked for additional subnets (and this @config is not a
+            # member of a Server Pool, which has different semantics), create
+            # extra interfaces to accomodate.
+            if !@config['vpc']['subnets'].nil? and @config['basis'].nil?
+              device_index = 1
+              mySubnets.each { |s|
+                next if s.cloud_id == cloud_desc.subnet_id
+
+                if cloud_desc.placement.availability_zone != s.az
+                  MU.log "Cannot create interface in subnet #{s.to_s} for #{@mu_name} due to AZ mismatch", MU::WARN
+                  next
+                end
+                MU.log "Adding network interface on subnet #{s.cloud_id} for #{@mu_name}"
+                iface = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).create_network_interface(subnet_id: s.cloud_id).network_interface
+                MU::Cloud::AWS.createStandardTags(
+                  iface.network_interface_id,
+                  region: @config['region'],
+                  credentials: @config['credentials'],
+                  optional: @config['optional_tags'],
+                  nametag: @mu_name+"-ETH"+device_index.to_s,
+                  othertags: @config['tags']
+                )
+
+                MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).attach_network_interface(
+                  network_interface_id: iface.network_interface_id,
+                  instance_id: cloud_desc.instance_id,
+                  device_index: device_index
+                )
+                device_index = device_index + 1
+              }
+              cloud_desc(use_cache: false)
+            end
+          end
+
+          [:private_dns_name, :public_dns_name, :private_ip_address, :public_ip_address].each { |field|
+            @config[field.to_s] = cloud_desc.send(field)
+          }
+
+          if !@config['add_private_ips'].nil?
+            cloud_desc.network_interfaces.each { |int|
+              if int.private_ip_address == cloud_desc.private_ip_address and int.private_ip_addresses.size < (@config['add_private_ips'] + 1)
+                MU.log "Adding #{@config['add_private_ips']} extra private IP addresses to #{cloud_desc.instance_id}"
+                MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).assign_private_ip_addresses(
+                  network_interface_id: int.network_interface_id,
+                  secondary_private_ip_address_count: @config['add_private_ips'],
+                  allow_reassignment: false
+                )
+              end
+            }
+          end
+        end
+
+        def tagVolumes
+          volumes = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_volumes(filters: [name: "attachment.instance-id", values: [@cloud_id]])
+          volumes.each { |vol|
+            vol.volumes.each { |volume|
+              volume.attachments.each { |attachment|
+                MU::Cloud::AWS.createStandardTags(
+                  attachment.volume_id,
+                  region: @config['region'],
+                  credentials: @config['credentials'],
+                  optional: @config['optional_tags'],
+                  nametag: ["/dev/sda", "/dev/sda1"].include?(attachment.device) ? "ROOT-"+@mu_name : @mu_name+"-"+attachment.device.upcase,
+                  othertags: @config['tags']
+                )
+  
+              }
+            }
+          }
+        end
+
+        # If we came up via AutoScale, the Alarm module won't have had our
+        # instance ID to associate us with itself. So invoke that here.
+        # XXX might be possible to do this with regular alarm resources and
+        # dependencies now
+        def setAlarms
+          if !@config['basis'].nil? and @config["alarms"] and !@config["alarms"].empty?
+            @config["alarms"].each { |alarm|
+              alarm_obj = MU::MommaCat.findStray(
+                "AWS",
+                "alarms",
+                region: @config["region"],
+                deploy_id: @deploy.deploy_id,
+                name: alarm['name']
+              ).first
+              alarm["dimensions"] = [{:name => "InstanceId", :value => @cloud_id}]
+
+              if alarm["enable_notifications"]
+                # XXX vile, this should be a sibling resource generated by the
+                # parser
+                topic_arn = MU::Cloud.resourceClass("AWS", "Notification").createTopic(alarm["notification_group"], region: @config["region"], credentials: @config['credentials'])
+                MU::Cloud.resourceClass("AWS", "Notification").subscribe(topic_arn, alarm["notification_endpoint"], alarm["notification_type"], region: @config["region"], credentials: @config["credentials"])
+                alarm["alarm_actions"] = [topic_arn]
+                alarm["ok_actions"]  = [topic_arn]
+              end
+
+              alarm_name = alarm_obj ? alarm_obj.cloud_id : "#{@mu_name}-#{alarm['name']}".upcase
+
+              MU::Cloud.resourceClass("AWS", "Alarm").setAlarm(
+                name: alarm_name,
+                ok_actions: alarm["ok_actions"],
+                alarm_actions: alarm["alarm_actions"],
+                insufficient_data_actions: alarm["no_data_actions"],
+                metric_name: alarm["metric_name"],
+                namespace: alarm["namespace"],
+                statistic: alarm["statistic"],
+                dimensions: alarm["dimensions"],
+                period: alarm["period"],
+                unit: alarm["unit"],
+                evaluation_periods: alarm["evaluation_periods"],
+                threshold: alarm["threshold"],
+                comparison_operator: alarm["comparison_operator"],
+                region: @config["region"],
+                credentials: @config['credentials']
+              )
+            }
+          end
+        end
+
+        # We have issues sometimes where our dns_records are pointing at the wrong node name and IP address.
+
+        def getIAMProfile
+          arn = if @config['generate_iam_role']
+            role = @deploy.findLitterMate(name: @config['name'], type: "roles")
+            s3_objs = ["#{@deploy.deploy_id}-secret", "#{role.mu_name}.pfx", "#{role.mu_name}.crt", "#{role.mu_name}.key", "#{role.mu_name}-winrm.crt", "#{role.mu_name}-winrm.key"].map { |file| 
+              'arn:'+(MU::Cloud::AWS.isGovCloud?(@config['region']) ? "aws-us-gov" : "aws")+':s3:::'+MU::Cloud::AWS.adminBucketName(@credentials)+'/'+file
+            }
+            MU.log "Adding S3 read permissions to #{@mu_name}'s IAM profile", MU::NOTICE, details: s3_objs
+            role.cloudobj.injectPolicyTargets("MuSecrets", s3_objs)
+  
+            @config['iam_role'] = role.mu_name
+            role.cloudobj.createInstanceProfile
+  
+          elsif @config['iam_role'].nil?
+            raise MuError, "#{@mu_name} has generate_iam_role set to false, but no iam_role assigned."
+          end
+
+          if !@config["iam_role"].nil?
+            if arn
+              return {arn: arn}
+            else
+              return {name: @config["iam_role"]}
+            end
+          end
+
+          nil
+        end
+
+        def setDeleteOntermination(device, delete_on_termination = false)
+          mappings = MU.structToHash(cloud_desc.block_device_mappings)
+          mappings.each { |vol|
+            if vol[:ebs]
+              vol[:ebs].delete(:attach_time)
+              vol[:ebs].delete(:status)
+            end
+            if vol[:device_name] == device
+              if vol[:ebs][:delete_on_termination] != delete_on_termination
+                vol[:ebs][:delete_on_termination] = delete_on_termination
+                MU.log "Setting delete_on_termination flag to #{delete_on_termination.to_s} on #{@mu_name}'s #{dev}"
+                MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).modify_instance_attribute(
+                  instance_id: @cloud_id,
+                  block_device_mappings: mappings
+                )
+              end
+              return true
+            end
+          }
+
+          false
+        end
+
+        def createImage
+          img_cfg = @config['create_image']
+          # Scrub things that don't belong on an AMI
+          session = windows? ? getWinRMSession : getSSHSession
+          sudo = purgecmd = ""
+          sudo = "sudo" if @config['ssh_user'] != "root"
+          if windows?
+            purgecmd = "rm -rf /cygdrive/c/mu_installed_chef"
+          else
+            purgecmd = "rm -rf /opt/mu_installed_chef"
+          end
+          if img_cfg['image_then_destroy']
+            if windows?
+              purgecmd = "rm -rf /cygdrive/c/chef/ /home/#{@config['windows_admin_username']}/.ssh/authorized_keys /home/Administrator/.ssh/authorized_keys /cygdrive/c/mu-installer-ran-updates /cygdrive/c/mu_installed_chef"
+              # session.exec!("powershell -Command \"& {(Get-WmiObject -Class Win32_Product -Filter \"Name='UniversalForwarder'\").Uninstall()}\"")
+            else
+              purgecmd = "#{sudo} rm -rf /var/lib/cloud/instances/i-* /root/.ssh/authorized_keys /etc/ssh/ssh_host_*key* /etc/chef /etc/opscode/* /.mu-installer-ran-updates /var/chef /opt/mu_installed_chef /opt/chef ; #{sudo} sed -i 's/^HOSTNAME=.*//' /etc/sysconfig/network"
+            end
+          end
+          if windows?
+            session.run(purgecmd)
+          else
+            session.exec!(purgecmd)
+          end
+          session.close
+          ami_ids = MU::Cloud::AWS::Server.createImage(
+              name: @mu_name,
+              instance_id: @cloud_id,
+              storage: @config['storage'],
+              exclude_storage: img_cfg['image_exclude_storage'],
+              copy_to_regions: img_cfg['copy_to_regions'],
+              make_public: img_cfg['public'],
+              region: @config['region'],
+              tags: @config['tags'],
+              credentials: @config['credentials']
+          )
+          @deploy.notify("images", @config['name'], ami_ids)
+          @config['image_created'] = true
+          if img_cfg['image_then_destroy']
+            MU::Cloud::AWS::Server.waitForAMI(ami_ids[@config['region']], region: @config['region'], credentials: @config['credentials'])
+            MU.log "AMI #{ami_ids[@config['region']]} ready, removing source node #{@mu_name}"
+            MU::Cloud::AWS::Server.terminateInstance(id: @cloud_id, region: @config['region'], deploy_id: @deploy.deploy_id, mu_name: @mu_name, credentials: @config['credentials'])
+            destroy
+          end
+        end
 
       end #class
     end #class