Keep most resources in the private subnet