Bug report: cannot move AWS::Elasticsearch::Domain resource to a new VPC

I'm trying to move an Elasticsearch domain from one VPC to another. The Elasticsearch domain contains two data nodes, each in a different AZ, and I'm using a ZoneAwarenessConfig with enabled set to True.

My update fails with:

The subnets must be in the same VPC. (Service: AWSElasticsearch; Status Code: 400; Error Code: ValidationException; Request ID: 1382cf1e-961a-40c0-b336-c43887d07c73; Proxy: null)

The change is itself is incredibly simple, the diff from the CDK is:

[~] AWS::Elasticsearch::Domain Elasticsearch/DocumentSearch ElasticsearchDocumentSearch78F67497
└─ [~] VPCOptions
└─ [~] .SubnetIds:
└─ @@ -1,8 +1,8 @@
[ ] [
[ ] {
[-] "Ref": "VpcPrivateSubnet1Subnet67A4DBCB"
[+] "Ref": "VpcTempVpcPrivateSubnet1SubnetF8F05905"
[ ] },
[ ] {
[-] "Ref": "VpcPrivateSubnet2SubnetC8EB537D"
[+] "Ref": "VpcTempVpcPrivateSubnet2SubnetFF8C4018"
[ ] }

The new subnets are both in the same VPC. It's hard to read this as anything other than a bug in Cloudformation.

It's also not possible to remove an Elasticsearch domain from a subnet. The update of the AWS::Elasticsearch::Domain fails with:

Internal Failure

The change once again is trivially simple:

[~] AWS::Elasticsearch::Domain Elasticsearch/DocumentSearch ElasticsearchDocumentSearch78F67497
└─ [-] VPCOptions
└─ {"SecurityGroupIds":[{"Fn::GetAtt":,"SubnetIds":}