CreateMountTarget now looks the subnet up in EC2 and takes the mount target's
VPC, Availability Zone and IP address from it, instead of reporting
vpc-12345678 and the region's first zone for every mount target. An unknown
subnet is refused with SubnetNotFound, and, as in AWS, a file system gets one
mount target per zone, all in one VPC (MountTargetConflict otherwise).
Lambda checks a function's VPC against its file system's mount targets, so the
made-up VPC kept consoles from finding the security group to use.
Zakaria