diff --git a/roles/aws/aws_ec2_with_eip/defaults/main.yml b/roles/aws/aws_ec2_with_eip/defaults/main.yml
index 76044a016..c88d12bed 100644
--- a/roles/aws/aws_ec2_with_eip/defaults/main.yml
+++ b/roles/aws/aws_ec2_with_eip/defaults/main.yml
@@ -27,6 +27,7 @@ aws_ec2_with_eip:
   root_volume_delete_on_termination: true
   ebs_optimized: true
   security_groups: [] # list of security group names, converted to IDs by aws_security_groups role
+  public_ip: true  # usually this needs to be true for cloud-init to work
   tags:
     Name: "{{ _domain_name }}"
   # Add an A record tied to the EIP.
diff --git a/roles/aws/aws_ec2_with_eip/tasks/main.yml b/roles/aws/aws_ec2_with_eip/tasks/main.yml
index 37ef61a20..7f13d4d1f 100644
--- a/roles/aws/aws_ec2_with_eip/tasks/main.yml
+++ b/roles/aws/aws_ec2_with_eip/tasks/main.yml
@@ -122,6 +122,8 @@
     name: "{{ aws_ec2_with_eip.instance_name }}"
     tags: "{{ aws_ec2_with_eip.tags }}"
     security_groups: "{{ _aws_security_group_list }}" # variable populated by the aws_security_groups role
+    network_interfaces:
+      - assign_public_ip: "{{ aws_ec2_with_eip.public_ip }}"
     ebs_optimized: "{{ aws_ec2_with_eip.ebs_optimized }}"
     volumes:
       - device_name: /dev/xvda