The Windows AMI products have now been created from a TPM-compatible baseline, which should allow you to use advanced security features such as Credential Guard on your production systems.
Information about the base AMIs can be found in the following Amazon support document: Launch a Windows instance with UEFI Secure Boot support
We will be providing documentation on how to enable these features within EC2 shortly, please check this page for updates.