diff --git a/resources/aws_ec2.go b/resources/aws_ec2.go
index f0bfa7ce..79f9f1bf 100644
--- a/resources/aws_ec2.go
+++ b/resources/aws_ec2.go
@@ -37,8 +37,13 @@ func init() {
 	RegisterResource("aws:ec2", func() Res { return &AwsEc2Res{} })
 }
 
-// AwsPrefix is a const which gets prepended onto the instance name.
-const AwsPrefix = "mgmt:"
+const (
+	// AwsPrefix is a const which gets prepended onto object names. We can only use
+	// alphanumeric chars, underscores and hyphens for sns topics and cloud watch rules.
+	AwsPrefix = "_mgmt-"
+	// waitTimeout is the duration in seconds of the timeout context in CheckApply.
+	waitTimeout = 400
+)
 
 // AwsRegions is a list of all AWS regions generated using ec2.DescribeRegions.
 // cn-north-1 and us-gov-west-1 are not returned, probably due to security.
@@ -441,8 +446,6 @@ func (obj *AwsEc2Res) longpollWatch() error {
 func (obj *AwsEc2Res) CheckApply(apply bool) (checkOK bool, err error) {
 	log.Printf("%s: CheckApply(%t)", obj, apply)
 
-	const waitTimeout = 400
-
 	diInput := ec2.DescribeInstancesInput{
 		Filters: []*ec2.Filter{
 			{