VPC hosts with public IP addresses will be provisioned through these.  Non-public-facing hosts will still be provisioned through an ssh tunnel.  This allows us to bootstrap the future 'bastion', the publicly accessible host through which we will provision non-public-facing hosts.