Parameterize AZs to clarify and fix gotcha with subnet<->AZ mismatch