Don't assume every AWS VPC has tags

The default VPC has no tags (by default), so we should use get()

Fixes: #2634