Why will launching EMR into one of my client's vpc just not work?

How long should I wait for the thing to boot strap.

I can see and ping the instances, but in the console it's stuck provisioning for 33 minutes now.

Master public DNS: blank

I don't get it.

subnet is public, auto assigns pub ips, hundreds of instances in private and public subnets have no problems.

What am I missing?

works fine in ec2 classic.