title: ASG can't launch instances anymore with encrypted EBS root volume
body: <p>We have recently deployed a new application that uses an ASG configured to launch instances with encrypted EBS root volumes. We have plenty of existing applications that work using exactly this setup, but our new ASG refuses to launch instances. The instances don't even appear and we see an error in the ASG activity history: <code>Client.InternalError: Client error on launch</code>.</p>
  
  <p>After experimenting, we've discovered that if we swap the AMI we are using for one that isn't encrypted it all starts working as expected. Confusingly we are using exactly the same AMI on a different ASG and it's all working as expected (formed from almost identical CloudFormation templates). Likewise we can launch an EC2 instance directly from the console using the same AMI and instance profile.</p>
  
  <p>Has anyone seen this behaviour before?</p>
  
  <p>I've found some solutions elsewhere (that led us to prove it was something to do with the encrypted volume) such as <a href="https://aws.amazon.com/premiumsupport/knowledge-center/encrypted-volumes-stops-immediately/" rel="noreferrer">this from AWS</a> but they don't seem to directly relate to our scenario.</p>