The ec2plugin gets into an infinite loop because it unregisters the httpclient for SPNEGO and thus Microsoft Negotiate. Then the httpclient was throwing an exception because negotiate was not supported. This exception was caught silently, making it look like the plugin was still pinging when it actually wasn't.
Commenting out "httpclient.getAuthSchemes().unregister(AuthPolicy.SPNEGO);" allowed me to connect to WinRM on the AMI just fine. However, I have no idea what unregistering for SPNEGO was needed for in the first place and what side effects that would cause. It looks like it's been there since it was originally written, and I can't find any information on it otherwise. Hopefully someone who knows better can comment.