EC2 is very different than ASGs, and params in VPC or with NetworkInterfaces are very different than without (inconsistent names of SecurityGroups, SecurityGroupIds, GroupSet, etc)

tropo_ec2_vpc_pubip.py

    # EC2 only
    # Can't use (EC2) SecurityGroups with Subnet
    # Can't use (VPC) SecurityGroupIds with NetworkInterfaces
    # Can't use SubnetId with NetworkInterfaces

    def add_ec2(self):
        name, tags = self._name_tags('ec2')
        self.ec2 = self.t.add_resource(
            ec2.Instance(
                name,
                ImageId=self.aws['ec2.image_id'],
                InstanceType=self.aws['ec2.instance_type'],
                KeyName=self.aws['ec2.key_name'],
                DependsOn=self.igw_attachment.name,  # required by NetworkInterfaces
                NetworkInterfaces=[
                    ec2.NetworkInterfaceProperty(
                        AssociatePublicIpAddress=True,
                        DeviceIndex='0',
                        GroupSet=[Ref(self.sg_ssh.name),  # LogicalName to ID
                                  Ref(self.sg_http.name),
                                  Ref(self.sg_https.name)],
                        SubnetId=Ref(self.subnet_app.name),
                    ),
                ],
                Tags=Tags(**tags),
                UserData=Base64(Join('', [
                    '#!/bin/bash -xe\n',
                    'export op_env={}\n'.format(self.aws['env']),
                    'apt-get update\n',
                    'apt-get install -y nginx\n',
                    ])),
            ))