This is incompatible with ec2-create-network-acl-entry.  Please replace it with "--allow" and "--deny" in a required MutuallyExclusiveArgList.  Both args can safely use the same `dest`.