
* Add a provisioning template of either type *finish* or *user_data* which will be executed on the new image.
   * 'finish' templates complete the provisioning process via SSH - this requires Foreman to be able to reach the IP of the new host, and that SSH is allowing connections from Foreman. This uses the SSH key which Foreman uploaded to your compute resource when it was added to Foreman.
   * 'user_data' templates instead provision by cloud-init (or similar meta-data retrieving scripts). This will not require Foreman to be able to reach the host, but the host must be able to reach Foreman (since user_data execution is asynchronous, the host must notify Foreman that the build is complete).
* Ensure AMIs are added under the *Images* tab on the compute resource
   * Ensure the correct username is set for Foreman to SSH into the image (if using SSH provisioning).
   * Tick the user_data box if the image is capable of using user_data scripts (usually because it has cloud-init installed).
* Enabling *use_uuid_for_certificates* in *Administer > Settings* is recommended for consistent Puppet certificate IDs instead of hostnames.
* VPC subnets and security groups can be selected on the *Network* tab when creating a host.
* The *Managed IP* dropdown menu allows selection between using the public and private IP address for communication from Foreman to the instance.
* Ensure that the selected template is associated to the OS (on the *Associations* tab) and is set as the default for the operating system too.

A finish-based example for configuring EC2 provisioning is given on the Foreman blog: [EC2 provisioning using Foreman](/2012/05/ec2-provisioning-using-foreman.html).
