@Answers4AWS Yes - I thought CIDR - you *could* allow the entire block, but what if @awscloud changes that - would be hard to update.