AMI from a domain-joined EC2 Windows

Cause 1 (Most likely): An AMI is being created directly from a domain-joined instance without running Sysprep.

Solution:

When creating a new AMI, remove the source instance from the domain and run Sysprep before creating the AMI. Alternatively, we recommend using a tool like Amazon EC2 Image Builder and modifying your design so that domain joining occurs dynamically after instance launch—using EC2Launch v2 or UserData scripts (keeping the "Golden AMI" itself in a non-domain-joined state is a best practice).

Cause 2: A security group with no outbound rules is completely blocking communication with the Domain Controller (DC).

Solution: Add outbound rules to allow traffic to the Domain Controller on at least the following ports:

Few points to check

1. SG by default blocks all inbound traffic. So please enable inbound traffic to allow login to instance.
2. SG by default allow outbound traffic as SG is stateful way to protect your instances