You might want to have a warning "If you do this it will take a really long time unless you upgrade to a t2.medium blah." My vpc flow logs often run into the 26M/day and would be nice to put in a day's worth if I could run it over night. I don't mind upgrading to higher level instances.
P.S. Great tool. Laser focused and I don't have to have 10,000 instances of elastic search.