Should secondary IP addresses assigned to vSEC in AWS be present in topology?

[Vladimir]

AWS requires introduction of secondary IP addresses and EIPs associated with them in order to access servers behind vSEC.

Once address is created and the EIP assigned, the traffic seem to flow through the vSEC,

My question is this:

Should the secondary IP be defined as an alias for the external interface of the vSEC?