Now if you are referring to having the rancher install in your datacenter but building a cluster on AWS that it manages, that works just fine and I can tell you from experience that vpn tunnels are not required so long as the cluster can hit the rancher UI on https.