vpc hosts always use internal ip
set_roles doesn't require args