My canonical example is “instances may not be placed in a subnet with a route to an internet gateway”