This will also need EC2 update access to the role and aws cli configured into the userdata script. At least that with the default region.

like below

aws configure set default.region <your_region>