refer to template for VPCs with private subnets