Please add aws-cfn-boostrap package to CA API Gateway AMI in AWS market place. It brings in AWS CLI commands. One important command is “aws s3 copy”. It allows me to download from internal non-public role protected S3 buckets. My EC2-instance does not have access to directly download the rpm from external public AWS S3 URL. CloudFormation helper scripts, such as cfn-init is also very important for AWS automation.