You could always just get the entire list of AWS public ranges and use that to identify interesting traffic… Of course that would vpn all AWS stuff.

If you have a list of domains, you could schedule a script to resolve each to IPs and rebuild your VPN definition every night.