Correct, but I don't think it's a safe assumption that approved resources wouldn't have a reason to block requests from the cloud.