Sorry, when I said "if you can do without it", with "it" I meant the application access layer, not the vpc.