AWS VPC Subnet Planning: Best Practices for /24 to /28 Networks

Designing a cloud network architecture requires careful calculation of Classless Inter-Domain Routing (CIDR) block allocations. In Amazon Web Services (AWS), a Virtual Private Cloud (VPC) defines an isolated virtual network dedicated to your cloud infrastructure. Subnets partition this IP address space into logical segments.

Improper CIDR sizing often leads to IP address exhaustion, routing complications, and costly network refactoring. This guide outlines standard subnet allocation patterns and essential rules for enterprise cloud deployments.

Understanding AWS IP Address Reservations

When you provision a subnet in AWS, the platform automatically reserves five IP addresses within every CIDR block. You cannot assign these reserved addresses to Amazon EC2 instances, Application Load Balancers, or container tasks.

For a standard /24 subnet containing 256 total IP addresses (from 10.0.1.0 to 10.0.1.255), AWS reserves the following:

1. 10.0.1.0: Network address.
2. 10.0.1.1: Reserved by AWS for the VPC router.
3. 10.0.1.2: Reserved by AWS for Domain Name System (DNS) resolution.
4. 10.0.1.3: Reserved by AWS for future functionality.
5. 10.0.1.255: Network broadcast address (AWS VPC does not support broadcast, but reserves this address).

Consequently, a /24 CIDR block yields exactly 251 usable IP addresses rather than the theoretical 254.

Subnet Size Allocation Reference Table

The following matrix provides a clear breakdown of total IP capacity versus usable host capacity across common VPC prefix lengths:

Multi-AZ Subnet Architecture Patterns

High availability in cloud infrastructure mandates distributing resources across multiple Availability Zones (AZs). A typical production VPC spanning three Availability Zones follows a structured layout:

1. Public Subnets (Ingress Tier)

Allocated with a /24 CIDR block per Availability Zone. Public subnets host Internet-facing Application Load Balancers (ALB) and NAT Gateways.

2. Private Application Subnets (Workload Tier)

Allocated with a /20 or /22 CIDR block per Availability Zone. This space hosts ECS tasks, EKS worker nodes, and backend microservices that require internet egress through NAT Gateways without receiving direct incoming connections.

3. Private Data Subnets (Database Tier)

Allocated with a /26 or /27 CIDR block per Availability Zone. This isolated environment hosts Amazon RDS instances, Elasticache clusters, and Aurora database replicas with no internet access.

Key Best Practices to Prevent IP Exhaustion

1. Plan for Container Density: Kubernetes pods (such as AWS VPC CNI) require individual secondary IP addresses assigned to Elastic Network Interfaces (ENIs). Sizing private application subnets at /20 or /21 ensures sufficient pod IP capacity.
2. Avoid Overlapping CIDR Blocks: Ensure your VPC IP range does not overlap with corporate on-premises networks or peer VPCs to maintain seamless Site-to-Site VPN and Transit Gateway connectivity.
3. Utilize Secondary CIDR Blocks: If a VPC runs out of IP addresses, AWS allows associating additional secondary IPv4 CIDR blocks without rebuilding the VPC.

Calculate CIDR Ranges Instantly with Yurlie

Calculate netmasks, broadcast boundaries, usable host counts, and binary structures instantly using the free Yurlie CIDR Subnet Calculator.