One thing I've noticed having worked with many clients, is that legacy architectures that get moved to AWS start by creating subnets, NACLs, etc. while for almost all AWS-first developed applications the Security Group is the smallest unit you tend to address.<p>So a legacy architecture will for instance specify the "frontend servers subnet" (and a unique SG, hopefully!), while a cloud-native architecture will only specify a SG. I think, asking which subnet some machine is in, is kind of like asking which core some process is running on at the moment: any one of the subnets for any one of the availability zones in that region, and the next one will automatically and on purpose be assigned to a different one by the ALB/ASG combination.