I guess I don't want a socket listening. If AWS would publish their subnets maybe I could limit it to those addresses. It sure seems like they could keep their subnets dynamic and accommodate something like this but I guess not.