This seemed to be something that was missing from their VPC offering -- I'll probably use it, but you still need an instance with a public ip for administration

This seemed to be something that was missing from their VPC offering -- I'll probably use it, but you still need an instance with a public ip for administration into the other instances on the private subnets if you're not using an ipsec VPN AFAICT.