Try this

playbooks/groups/sign.yml

@@ -1,29 +0,0 @@
-# provision a new sign server.
-# NOTE: this assumes the boxes are already up and are accessible
-# NOTE: most of these vars_path come from group_vars/sign or from hostvars
-#
-# FURTHER NOTE: some of These machines run day to day with sshd disabled/off. 
-# Access is via management interface only. This playbook does initial setup. 
-# Please check with rel-eng before doing anything here. 
-
-- name: make sign server
-  hosts: sign
-  user: root
-  gather_facts: true
-
-  vars_files: 
-   - /srv/web/infra/ansible/vars/global.yml
-   - "{{ private }}/vars.yml"
-   - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
-
-  roles:
-  - /srv/web/infra/ansible/roles/base
-  - /srv/web/infra/ansible/roles/rkhunter
-
-  tasks:
-  - include: "{{ tasks }}/serialgetty.yml"
-  - include: "{{ tasks }}/motd.yml"
-  - include: "{{ tasks }}/sign_setup.yml"
-
-  handlers:
-  - include: "{{ handlers }}/restart_services.yml"

vars/global.yml

@@ -20,7 +20,8 @@ f17_qcow_id: ami-00000001
 f19_qcow_id: ami-00000020
 # Fedora-20-TC4-x86_64
 f20_qcow_id: ami-00000038
-ec2_userdata: ['#cloud-config', 'disable_root: 0']
+ec2_userdata: ['#cloud-config
+disable_root: 0']
 global_pkgs_inst: ['bind-utils', 'joe', 'mailx', 'nc', 'openssh-clients', 
                    'patch', 'postfix', 'rsync', 'strace', 'telnet', 
                    'tmpwatch', 'traceroute', 'vim-enhanced', 'xz', 'zsh',