It looks like you left your public key in authorized_keys. I guess it was an honest mistake, but at the very least anyone using this AMI should remove it.

Now, please don't be offended, but this is one of the reasons I prefer instructions or more generally an easy way to replicate a result - which is easier to verify - rather than the built software/AMI/whatever. It's trivial to offer a compromised system and nearly impossible to verify that a system is secure.

On the other hand, tor and obfsproxy work for me using your AMI.