AWS VPC CIDR Block Planning and Subnet Sizing

This lesson explains how to choose CIDR blocks for an Amazon VPC and its subnets before building the network. For the AWS Certified Solutions Architect – Professional SAP-C02 exam, this matters because many architecture questions assume you can design scalable, non-overlapping, multi-AZ network layouts.

CIDR planning affects:

• How many subnets you can create
• How many IP addresses are available in each subnet
• Whether the VPC can support future growth
• Whether the VPC can connect to other networks without IP conflicts
• Whether migration, hybrid connectivity, or multi-account networking becomes difficult later

The main takeaway is simple: plan your VPC address space carefully before deploying workloads, because changing the CIDR strategy later can be disruptive.

Key Concepts

CIDR Blocks in AWS VPC Networking

CIDR stands for Classless Inter-Domain Routing. In AWS, CIDR notation defines the IP address range assigned to a VPC or subnet.

A CIDR block looks like this:

10.0.0.0/16

The /16 portion is the subnet mask. It tells you how many bits are used for the network portion of the address. The remaining bits are available for host addressing.

For example:

CIDR Block	Total IPv4 Addresses	General Meaning
10.0.0.0/16	65,536	Large VPC address space
10.0.0.0/20	4,096	Common subnet size for larger environments
10.0.0.0/24	256	Smaller subnet, often used in traditional networks
10.0.0.0/28	16	Smallest IPv4 subnet size allowed in AWS

For the exam, remember that a larger prefix number means a smaller network. A /24 is smaller than a /16, and a /28 is much smaller than a /20.

AWS VPC CIDR Size Rules

When creating an IPv4 VPC CIDR block, AWS allows sizes from:

• Largest: /16
• Smallest: /28

A /16 gives the largest private IPv4 address pool available for a VPC CIDR block. A /28 gives only 16 total addresses and is usually too small for most practical subnet designs.

AWS recommends using private IPv4 address ranges defined by RFC 1918:

Private Range	CIDR Range
10.0.0.0/8	10.0.0.0 through 10.255.255.255
172.16.0.0/12	172.16.0.0 through 172.31.255.255
192.168.0.0/16	192.168.0.0 through 192.168.255.255

For AWS architecture, 10.0.0.0/16 is a common training and lab example because it provides plenty of address space and is easy to subnet.

Network Bits and Host Bits

A CIDR block divides an IP address into two parts:

• Network portion
• Host portion

For example:

192.168.0.0/24

In this case, 24 bits are used for the network portion, leaving 8 bits for host addresses.

Eight host bits provide:

2^8 = 256 total addresses

In traditional networking, the first address is the network address and the last address is the broadcast address. AWS reserves additional addresses beyond that, so you do not get to use every address in the range.

AWS Reserved IP Addresses

AWS reserves five IPv4 addresses in every subnet:

Address Position	Example in 10.0.0.0/24	Purpose
First address	10.0.0.0	Network address
Second address	10.0.0.1	VPC router
Third address	10.0.0.2	Amazon-provided DNS
Fourth address	10.0.0.3	Reserved for future AWS use
Last address	10.0.0.255	Broadcast address, though broadcast is not supported in VPCs

This is a common exam gotcha. A subnet does not provide all listed addresses to EC2 instances or other resources.

For example:

Subnet	Total Addresses	AWS Reserved	Usable Addresses
/24	256	5	251
/20	4,096	5	4,091
/28	16	5	11

Variable Length Subnet Masks

AWS supports classless networking, which means subnet boundaries do not need to align perfectly with old classful network ranges.

For example, a /20 subnet uses 20 bits for the network portion and leaves 12 bits for host addressing.

2^12 = 4,096 total addresses

A /20 subnet inside a 10.0.0.0/16 VPC might look like:

Subnet Number	CIDR Block	Total Addresses
Subnet 1	10.0.0.0/20	4,096
Subnet 2	10.0.16.0/20	4,096
Subnet 3	10.0.32.0/20	4,096
Subnet 4	10.0.48.0/20	4,096

Notice that the second subnet starts at 10.0.16.0, not 10.0.1.0. That is because a /20 subnet increments by 16 in the third octet.

This is important when reading exam questions that show subnet ranges. If CIDR math is wrong, the proposed answer may be invalid.

Balancing Number of Subnets and Hosts per Subnet

CIDR planning is a tradeoff.

If you make subnets very large, each subnet has more available IPs, but you can create fewer subnets from the VPC range.

If you make subnets smaller, you can create more subnets, but each subnet has fewer available IPs.

For example, starting with a 10.0.0.0/16 VPC:

Subnet Size	Total Addresses per Subnet	Approximate Number of Subnets from /16
/20	4,096	16
/21	2,048	32
/22	1,024	64
/24	256	256
/26	64	1,024
/28	16	4,096

The best design depends on the environment.

For a production VPC, you usually need to consider:

• Number of Availability Zones
• Public subnets
• Private application subnets
• Private database subnets
• Inspection or firewall subnets
• Load balancer requirements
• NAT Gateway placement
• Kubernetes, ECS, or autoscaling workloads
• Future expansion
• Hybrid connectivity
• Multi-account networking
• IP overlap with on-premises networks

CIDR Blocks Cannot Overlap

A VPC CIDR block must not overlap with another CIDR block associated with the same VPC.

This also matters when connecting networks together. Even if AWS technically allows you to create a VPC with a CIDR range, that does not mean it is a good design.

Avoid overlaps with:

• On-premises data centers
• Branch offices
• VPN-connected networks
• Direct Connect networks
• Other AWS VPCs
• Transit Gateway-connected networks
• Peered VPCs
• Other cloud networks such as Azure or Google Cloud

For SAP-C02, overlapping CIDR blocks commonly appear in questions about VPC peering, Transit Gateway, hybrid networking, mergers, migrations, or multi-account environments.

You Cannot Resize an Existing VPC CIDR Block

After a VPC CIDR block exists, you cannot simply resize it from something like /24 to /16.

This is why upfront planning matters.

If you choose a VPC range that is too small, your options later may include:

• Add a secondary IPv4 CIDR block to the VPC, if suitable
• Create a new VPC with a better CIDR design
• Migrate workloads to the new VPC
• Redesign subnet layout
• Use additional VPCs and route between them
• Use IPv6 where appropriate
• Reduce IP consumption by changing workload architecture

For exam questions, AWS generally expects you to avoid painting yourself into a corner by choosing a VPC CIDR that supports future growth.

Subnet CIDRs Cannot Be Changed After Creation

After creating a subnet, you cannot change its IPv4 CIDR block.

If the subnet is too small, you usually need to:

1. Create a new subnet with the correct CIDR block.
2. Move workloads or redeploy resources.
3. Update route tables, security groups, NACLs, and dependencies.
4. Remove the old subnet when it is no longer needed.

This is operationally disruptive, especially when subnets contain EC2 instances, load balancers, NAT Gateways, databases, endpoints, or container workloads.

Example VPC Design Using /16 and /20

A simple lab design might use:

• VPC CIDR: 10.0.0.0/16
• Subnet size: /20

This gives 16 possible /20 subnets inside the VPC.

Example subnet layout:

Purpose	Availability Zone	CIDR Block
Public subnet 1	AZ A	10.0.0.0/20
Public subnet 2	AZ B	10.0.16.0/20
Private app subnet 1	AZ A	10.0.32.0/20
Private app subnet 2	AZ B	10.0.48.0/20
Private database subnet 1	AZ A	10.0.64.0/20
Private database subnet 2	AZ B	10.0.80.0/20

This design leaves additional address space for future subnets, such as:

• Additional Availability Zones
• Inspection subnets
• VPC endpoints
• Redundant NAT Gateway architecture
• Separate application tiers
• Migration staging subnets
• Security tooling subnets

Exam-Relevant Takeaways

For the SAP-C02 exam, remember these points:

• AWS IPv4 VPC CIDR blocks can range from /16 to /28.
• AWS reserves five IP addresses in every subnet.
• A /20 subnet contains 4,096 total addresses, but only 4,091 are usable in AWS.
• A /24 subnet contains 256 total addresses, but only 251 are usable in AWS.
• The VPC CIDR must not overlap with other CIDRs associated with the VPC.
• Avoid CIDR overlap with on-premises, peered VPCs, Transit Gateway attachments, and other cloud networks.
• You cannot resize an existing VPC CIDR block.
• You cannot change an IPv4 subnet CIDR after creating the subnet.
• Poor CIDR planning can force workload migration later.
• Larger subnets provide more host capacity but reduce the number of subnets available.
• Smaller subnets provide more segmentation but can run out of IP addresses quickly.
• Use RFC 1918 private IP ranges unless there is a specific reason not to.
• Design for multiple Availability Zones from the beginning.
• Leave room for future growth, security tooling, endpoints, and migration needs.

Architecture Decision Guide

Scenario	Best AWS Choice	Why
Building a new production VPC with room for growth	Use a larger VPC CIDR such as /16	Provides maximum flexibility for multiple subnets, AZs, and future expansion
Need around 4,000 addresses per subnet	Use /20 subnets	/20 provides 4,096 total addresses, with 4,091 usable in AWS
Need many small isolated subnets	Use smaller subnet ranges such as /24, /25, or /26	Allows more subnet segmentation but reduces available IPs per subnet
Need to connect AWS to on-premises	Choose non-overlapping RFC 1918 ranges	Prevents routing conflicts across VPN, Direct Connect, or Transit Gateway
Existing subnet is too small	Create a new subnet and migrate resources	IPv4 subnet CIDRs cannot be resized after creation
Existing VPC CIDR is too small	Consider secondary CIDR or migrate to a better-designed VPC	Existing VPC CIDRs cannot simply be resized
Designing for multi-AZ architecture	Allocate equivalent subnet groups per AZ	Supports high availability and clean routing/security design
Exam answer suggests overlapping VPC CIDRs for peering or Transit Gateway	Reject that answer	Overlapping CIDRs break routing and are a common exam trap
Need future room for endpoints, NAT Gateways, firewalls, and migrations	Reserve unused subnet ranges	Prevents expensive redesign later

Common Exam Traps

Trap 1: Assuming All IPs in a Subnet Are Usable

A /24 has 256 total addresses, but AWS reserves five. The usable count is 251, not 254 or 256.

Trap 2: Forgetting AWS Reserves More Than Network and Broadcast

Traditional networking reserves the network and broadcast addresses. AWS reserves those plus additional addresses for router, DNS, and future AWS use.

Trap 3: Choosing a CIDR Block That Overlaps with On-Premises

A VPC may work fine in isolation but fail during VPN, Direct Connect, Transit Gateway, or VPC peering design if it overlaps with another network.

Trap 4: Thinking a VPC CIDR Can Be Resized Later

You cannot simply expand 10.0.0.0/24 into 10.0.0.0/16 after the fact. You need to plan the address space before deploying workloads.

Trap 5: Making Subnets Too Small

Small subnets may look organized, but services such as Auto Scaling, load balancers, containers, and VPC endpoints can consume IPs quickly.

Trap 6: Making Subnets Too Large Without a Plan

Large subnets provide more hosts, but they reduce how many subnets you can carve from the VPC. This can limit segmentation and future expansion.

Trap 7: Forgetting Multi-AZ Requirements

Many AWS services expect subnets across multiple Availability Zones. A single-subnet design is usually not resilient enough for production scenarios.

Trap 8: Misreading CIDR Boundaries

A /20 increments by 16 in the third octet when starting from 10.0.0.0. So the next /20 after 10.0.0.0/20 is 10.0.16.0/20, not 10.0.1.0/20.

Real-World Engineer Notes

CIDR planning is one of those design decisions that seems simple during lab work but becomes painful in real environments.

In a real AWS environment, you should plan VPC CIDRs with the following in mind:

• Existing on-premises IP ranges
• Future site-to-site VPNs
• Direct Connect
• AWS Transit Gateway
• VPC peering
• Multi-account landing zones
• Shared services VPCs
• Security inspection VPCs
• Kubernetes or ECS IP consumption
• Interface VPC endpoints
• Load balancer scaling
• Blue/green migrations
• Disaster recovery environments

Poor IP planning can cause expensive rework. If a VPC overlaps with another network, you may not be able to route traffic between them cleanly. That can impact migrations, acquisitions, shared services, centralized inspection, and hybrid access.

From an operations standpoint, running out of IP addresses in a subnet can cause confusing failures. EC2 launches may fail, Auto Scaling groups may not scale, load balancers may have issues, and managed services may not be able to attach network interfaces. The failure may look like a service issue when the real cause is subnet exhaustion.

For governance, larger organizations often manage IP allocation centrally using tools such as IPAM. AWS VPC IP Address Manager can help plan, track, and audit IP usage across accounts and Regions.

For production designs, avoid using random CIDR ranges just because they work in a lab. Treat VPC CIDR allocation like enterprise network architecture.

Quick Reference Summary

• CIDR notation defines the address range for VPCs and subnets.
• AWS VPC IPv4 CIDRs can be from /16 to /28.
• Subnet IPv4 CIDRs can also be from /16 to /28.
• AWS reserves five IP addresses per subnet.
• A /16 provides 65,536 total IPv4 addresses.
• A /20 provides 4,096 total IPv4 addresses.
• A /24 provides 256 total IPv4 addresses.
• Usable AWS subnet IPs equal total addresses minus five.
• CIDR blocks must not overlap within the VPC.
• Avoid overlap with on-premises and connected networks.
• You cannot resize an existing VPC CIDR block.
• You cannot change an IPv4 subnet CIDR after creation.
• Larger subnets provide more host capacity.
• Smaller subnets provide more segmentation.
• Plan for multi-AZ, hybrid networking, and future growth from the start.

Flashcards

Q: What does CIDR define in AWS VPC networking?
A: CIDR defines the IP address range assigned to a VPC or subnet.

Q: What is the largest IPv4 CIDR block size allowed for an AWS VPC?
A: /16.

Q: What is the smallest IPv4 CIDR block size allowed for an AWS VPC?
A: /28.

Q: How many total IPv4 addresses are in a /16 CIDR block?
A: 65,536.

Q: How many total IPv4 addresses are in a /20 CIDR block?
A: 4,096.

Q: How many IP addresses does AWS reserve in each subnet?
A: Five.

Q: How many usable IPv4 addresses are available in a /24 AWS subnet?
A: 251 usable addresses.

Q: Why is 10.0.16.0/20 the next subnet after 10.0.0.0/20?
A: A /20 subnet increments by 16 in the third octet.

Q: Can you resize an existing VPC CIDR block from /24 to /16?
A: No. You cannot directly resize an existing VPC CIDR block.

Q: Can you change an IPv4 subnet CIDR after creating the subnet?
A: No. You must create a new subnet and migrate resources.

Q: Why should VPC CIDR blocks avoid overlapping with on-premises networks?
A: Overlapping CIDRs cause routing conflicts with VPN, Direct Connect, Transit Gateway, and peering connections.

Q: What private IP ranges does AWS commonly recommend for VPC design?
A: RFC 1918 ranges: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.

Q: What is the tradeoff between large and small subnets?
A: Large subnets provide more host IPs but fewer total subnets; small subnets provide more segmentation but fewer host IPs per subnet.

Q: Why is CIDR planning important before creating production workloads?
A: Poor CIDR choices can force disruptive migrations, routing redesigns, or subnet replacements later.

Practice Questions

Question 1:
A company is creating a new production VPC for workloads that will run across multiple Availability Zones. The environment is expected to grow over time and may later connect to an on-premises data center. Which design choice is most appropriate?

A. Create the VPC with a very small /28 CIDR block to reduce wasted addresses
B. Create the VPC with a large, non-overlapping private CIDR block such as /16
C. Use the same CIDR block as the on-premises network for consistency
D. Create one public subnet only and expand it later if needed

Correct Answer:
B

Explanation:
A larger non-overlapping private CIDR block gives the VPC room for multiple subnets, multiple Availability Zones, and future hybrid connectivity. Overlapping with on-premises networks creates routing problems.

---

Question 2:
An engineer creates a subnet with CIDR block 10.0.0.0/24. How many IPv4 addresses are usable by resources in AWS?

A. 256
B. 255
C. 254
D. 251

Correct Answer:
D

Explanation:
A /24 contains 256 total IPv4 addresses. AWS reserves the first four and the last address in every subnet, leaving 251 usable addresses.

---

Question 3:
A VPC uses CIDR block 10.0.0.0/16. The architect wants subnets with approximately 4,000 total addresses each. Which subnet size best fits this requirement?

A. /16
B. /20
C. /24
D. /28

Correct Answer:
B

Explanation:
A /20 subnet provides 4,096 total addresses. In AWS, five are reserved, leaving 4,091 usable addresses.

---

Question 4:
A team created a subnet that is now too small for its Auto Scaling group. What is the best operational approach?

A. Resize the existing subnet CIDR block
B. Change the subnet from /24 to /20 in place
C. Create a larger subnet and migrate or redeploy the workload
D. Add the same CIDR block to another VPC

Correct Answer:
C

Explanation:
IPv4 subnet CIDRs cannot be changed after subnet creation. The practical fix is to create a new subnet with the correct size and move or redeploy workloads.

---

Question 5:
A proposed VPC design uses a CIDR range that overlaps with the company’s on-premises network. The VPC will later connect to the data center using hybrid connectivity. What is the main issue?

A. AWS does not allow private IP addresses in a VPC
B. The VPC cannot contain public subnets
C. Overlapping CIDRs will create routing conflicts
D. AWS reserves all addresses in overlapping CIDR ranges

Correct Answer:
C

Explanation:
Overlapping CIDR blocks create routing ambiguity and can prevent clean connectivity across VPN, Direct Connect, Transit Gateway, or peering connections.