Trying to deploy a cdh cluster, the instances start, nodes get configured. But the security groups rules don't get created/added to the SG. No errors in the whirr.log file.
Adding the rules by hand, out of band from whirr fixes the issue. Instances get a working hadoop (at least hadoop fs -ls / works).