We don't have direct access to cloud, so go through subnet