make sure it ends up in a VPC by setting subnet