[20190111211123] T3, Security Groups, KMS Rotation, and Bug Fixes

[ddollar]

• #3062 switch to t3 instances by default [@ddollar]
• #3063 allow configuring a security group for private api access [@ddollar]
• #3065 restore resource link vars to one-off runs [@ddollar]
• #3066 enable kms annual rotation [@ddollar]