Comment 5 for bug 1364037

The main issue is that Juju controllers need to retrieve the binaries it runs from streams.canonical.com and that the client (typically running on an operator laptop outside the cloud) needs to be able to reach the controller API endpoints.

If you're getting an error during bootstrap about reaching port 17070 this is the Juju client you're running attempting to reach the controller machine that's come up. If it's a locked down VPC with no ingress from your client you'll get this issue.