emp run broke when splitting daemon on to separate controller cluster

[netproteus]

I've been running an empire cluster for a few months v0.12.0 with similar setup to the example cloud-formation template.

I'm trying to harden for production and split the controller from the minions and reduce the permission scopes.
I've tried to follow your stacker blueprint closely to do this

https://github.com/remind101/stacker_blueprints/tree/master/stacker_blueprints/empire

I've managed to get apps to run run ok but one casualty has been emp run

where I end up with output like this

$ emp run -a test-public sh

1c
Pulling from fiit/ecs-test

51
Digest: sha256:032b6b6bd4eff0891dbcc2208f61219938b290303a0b11c5da3b03eb723e0e41

36
Status: Image is up to date for fiit/ecs-test:latest

1

1

1

1

And the 1 characters repeat slowly.

I don't really understand how emp run works, I'm assuming I probably have a firewall or permissions problem, can you point me in the right direction of things I should be checking?