I had quite a bit of struggle in producing the AMI image. The main problem is that the image was so large that even uploading it to S3 from within EC2, the my SAML-derived token expired while the upload was still running. At least in my configuration, the aws s3 cp command did not automatically extend the token lifetime. I tried to overwrite the token configuration on the fly, but that did not help, either.

I would suggest to warn about the image sizes, and to ensure that before starting, one should make sure that the token lifetime is long enough for the upload. Ideally, there should be a better procedure to get the AMI image created, perhaps using a direct download from the Red Hat CDN.

(Eventually, I solved my issue by filing a ticket with Red Hat IT, and they increased the maximum token lifetime I could request in the environment.)