title: Provision Amazon EC2 instance with salt-cloud from a machine w/o public IP
body: <p>Ok, I am quite a newbie of the salt-stack world, but after 2 days being stuck with this issue I'm starting to feel a bit stupid too.</p>
  
  <p>I would like to have  a simple 1:1 configuration:</p>
  
  <ul>
  <li><p><strong>[Master]</strong> Vagrant/VirtualBox/Ubuntu with salt &amp; salt-cloud installed</p></li>
  <li><p><strong>[Minion]</strong> Amazon EC2 machine,  conveniently provisioned with state files I have in [Master].</p></li>
  </ul>
  
  <p>I have reached the step where I am able to create the Minion instance thanks to salt-cloud, but I am stuck at the next step: I don't know how I can</p>
  
  <ul>
  <li><p>Transfer .sls files to the Minion</p></li>
  <li><p>Run the top.sls at Minion side to perform the provision</p></li>
  </ul>
  
  <p>The fact is that any <code>salt-cloud</code> command seems to work (I am able to create, list, delete the Amazon EC2 instance by command line), but I cannot connect to the Minion with any <code>salt</code> command, I just get timeout (<code>"Minion did not return"</code>). </p>
  
  <p>Moreover I am not comfortable with this architecture because the Minion could receive Master's requests, but on the other end it doesn't have visibility of the Master, since the Master is not  publicly reachable (and I don't want to).</p>
  
  <p>What am I missing to be able to have an architecture as simple as this?</p>