The version is interpolated into the boot script. Reject anything that is not a vX.Y.Z tag.
The prod host will live on a subnet in the syslog VPC. The data volume stays unmanaged and is attached only after a snapshot copy.
