ElastiCache cluster is not using public subnets

# Terraform: ensure the cluster uses a subnet group with only private subnets
resource "aws_elasticache_subnet_group" "private" {
  name       = "<example_resource_name>"
  subnet_ids = ["<example_resource_id>", "<example_resource_id>"] # private subnets only
}

resource "aws_elasticache_cluster" "cache" {
  cluster_id      = "<example_resource_id>"
  engine          = "redis"
  node_type       = "cache.t3.micro"
  num_cache_nodes = 1
  subnet_group_name = aws_elasticache_subnet_group.private.name  # CRITICAL: restricts cluster to private subnets
}

# CloudFormation: move ElastiCache into private subnets via a private subnet group
Resources:
  PrivateCacheSubnetGroup:
    Type: AWS::ElastiCache::SubnetGroup
    Properties:
      Description: Private subnets only
      SubnetIds:
        - <example_resource_id>  # private subnet
        - <example_resource_id>  # private subnet

  CacheCluster:
    Type: AWS::ElastiCache::CacheCluster
    Properties:
      CacheClusterId: <example_resource_id>
      Engine: redis
      CacheNodeType: cache.t3.micro
      NumCacheNodes: 1
      CacheSubnetGroupName: !Ref PrivateCacheSubnetGroup  # CRITICAL: forces the cluster to use only private subnets