Do VPCs or subnets aggregate a larger block that can be used to write a firewall rule? I wouldn't find it quite as useful to have per-VM blocks issued piecemeal. It's not clear from the documentation that I read.