AWS instances in a private subnet are generally accessed via a VPN, but
many EC2 classic instances still have a public IP. We should use that
where possible, and fall back to a private IP if not.
This change is really overkill for just defining the state path.
However, this opens the door for additional configuration options
such as choosing the keys to match on for the "host" argument.