Blocking virtually all VPNs and VPS IP ranges is not the most pleasant practice. I realize this is likely a Hollywood demand, but absent any kind of other information from them, it sure appears that they are complicit in it.

Further, they make it essentially impossible to to create a local routing rule to bypass the VPN for them alone. You're stuck whitelisting the whole of AWS.