Since everything is behind the nat, the rabbit boxes don't have public IPs so
adding a hole to the nat for this doesn't make sense.  They are't reachable
from the outside world.

  - Add SSL forwarding to the Loadbalancer.
  - Perform the health check against the server's heartbeat page.

Until we support autoscaling we should keep min/max
the same.  We might want to make it 1/1.

Happened to notice this while I was in here, mostly a cosmetic fix.

We need to use the git protocol to access read-only git repos.  It's a
quirk that when these are referenced from pip files, they need to go
over a source control protocol.  I wish it could go over http/s or ssh,
but it can't, so port 9418 it is.

I had to open inbound and outbound 9418 to get this working, don't know
why.  Leaving both open for now, will debug later so we can close down.

You may want to deploy more app instances by default to start with.

It's a bummer that enabling VPC DNS hostnames isn't supported by
CloudFormation yet, so we have to do this manual command hack like
we're already doing for ElastiCache. Helpful bit for configuring your
ssh as well.

Need to be able to ssh *out* of our hosts to communicate with GitHub for
private repos. Add egress TCP port 22 access to the NATSecurityGroup.

Eventually we might want to set these thresholds to have better ranges,
but for trying the stack out I say that we shouldn't require an more
than the minimum number of machines.

Added defaults to some of the settings to make it more likely that
someone will get a stack up and running on the first try: deployment
key and environment tag.

Parameterized the availability zones instead of hardcoding them to
us-east-1. Each region has it's own notion of what is primary and
what is secondary, etc. because it seems that not all capabilities
work in all AZ's.  Specifically I got this error when trying to
create a VPC in us-west-1.

> Value (us-west-1b) for parameter availabilityZone is invalid. Subnets
> can currently only be created in the following availability zones:
> us-west-1c, us-west-1a.

For us-east-1 "B" and "C" are still the primary and secondary so EdX
shouldn't be affected. But in us-west-1 primary=A and secondary=C.
We'll have to learn over time what works best for other regions.

Reformatted the mapping sections to make them easier to read.  Hope
you don't mind.  Much terser and easier to eyeball.

Terser overall description.  Removed the "you'll be billed!" warning.

Change made in other tempates, doing for this template too. At some
point there was a copy/paste error and the eu-west-1 was used for
us-west-1. See 2cba8413

Looks like there was a copy/paste error, the AMI's that were in there
before were the same as Europe.  These new ones work.