use three subnets for wider AZ coverage