Currently customer's IT-security will not allow this product to be deployed inside their firewall to manage systems at Amazon: 

    Having systems connect back to inside their perimeter security is usually seen as breach of the security architecture. 

    A VPN actually makes it worse, because it moves the perimeter security to the cloud resource provider. 

This prohibits all major use-cases. Purely on-premise use-cases using RHEVM and/or VMWare may be feasible, but in my opinion for this case the RHEV-M user portal and Satellite/cobbler are more usable for now. Also, it leads to increased cost from a data transfer standpoint if data is not local within the provider.

This is a request to move to an architecture that allows update and entitlement of systems to occur in the cloud resource provider and have federation of the data into the on-premise system in a secure manner.