Use subnet group for param, not vpc securitygroup