The issue with using posted AMIs for this is the same as usual: they include god knows what else in addition to the installed and configured software (which is likely to also lag behind master / latest release quite a bit). Last few AMIs I tried for this included some random public keys as authorized users in a sudoer account! While they're likely benign (belonging to researchers that created these images), that'd be a nasty surprise to find in your data pipeline down the line.