AWS VPC CIDR Block Planning, Subnets, and Addressing – SAP-C02 Study Guide | AWS Systems Architect Professional

Study guide

Technical reference and lesson notes

Purpose of This Lesson

A VPC CIDR block defines the IPv4 address space available to a VPC. Choosing it correctly is an important architectural decision because the initial range must support current workloads, future growth, subnet segmentation, and potential connectivity to other networks.

Poor CIDR planning can create address exhaustion or overlapping ranges that prevent private routing between VPCs and on-premises networks.

Key Concepts

VPC CIDR block rules

For an IPv4 VPC CIDR block:

The block size must be between /16 and /28.
The primary CIDR block cannot be resized in place after creation.
Additional CIDR blocks can be associated with a VPC when more address space is needed, subject to AWS rules and available quotas.
The CIDR range must not overlap with existing CIDR blocks associated with that VPC.
AWS recommends using private ranges defined by RFC 1918:
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

For long-term designs, avoid overlapping ranges across VPCs, accounts, Regions, and connected corporate networks. Overlap may not prevent independent VPC creation, but it can prevent or complicate routing through VPC peering, AWS Transit Gateway, VPN, or Direct Connect.

Subnets use more-specific prefixes

A subnet carved from a VPC must have a longer prefix than the VPC CIDR block. For example:

VPC: 10.0.0.0/16
Subnets: 10.0.1.0/24, 10.0.2.0/24, and 10.0.3.0/24

A /16 contains 65,536 IPv4 addresses. Dividing it into /24 subnets borrows eight host bits, producing 256 possible /24 networks:

10.0.0.0/24
10.0.1.0/24
…
10.0.255.0/24

Each /24 contains 256 addresses before AWS reservations.

AWS-reserved subnet addresses

AWS reserves five IPv4 addresses in every subnet. For a subnet such as 10.0.1.0/24, the reserved addresses include:

Network address: 10.0.1.0
VPC router: 10.0.1.1
DNS: 10.0.1.2
Reserved for future use: 10.0.1.3
Broadcast address: 10.0.1.255

Therefore, a /24 provides 251 usable IPv4 addresses, not 256 or 254. AWS does not support IPv4 broadcast within a VPC, but the last address remains reserved.

Availability Zones and subnet design

A subnet belongs to one Availability Zone. A highly available architecture normally creates equivalent subnets in multiple Availability Zones, such as:

Public subnet in AZ 1
Public subnet in AZ 2
Private application subnet in AZ 1
Private application subnet in AZ 2
Private database subnet in AZ 1
Private database subnet in AZ 2

Subnet sizing should account for the workload tier, scaling requirements, interfaces created by AWS services, and future expansion. A subnet that is sufficient for a small deployment may become too small after adding load balancers, VPC endpoints, NAT gateways, container workloads, or additional network interfaces.

Public versus private subnets

A subnet is considered public when its route table has a route to an Internet Gateway. A subnet is private when it has no direct route to an Internet Gateway.

A public subnet does not automatically make an instance publicly reachable. Public access also depends on factors such as:

A public IPv4 address or Elastic IP address
Security group rules
Network ACL rules
Operating system and application configuration

Similarly, assigning a public IP address is not what makes a subnet public; the route table’s path to an Internet Gateway is the defining characteristic.

Architecture Decision Guide

Design decision	Recommended approach	Reason
Initial VPC range	Choose a sufficiently large private RFC 1918 range	The primary CIDR cannot be resized later
Connected environments	Use globally coordinated, non-overlapping ranges	Enables routing through peering, Transit Gateway, VPN, or Direct Connect
Subnet sizing	Size for current capacity plus growth and AWS-managed interfaces	Subnets cannot be resized directly and replacement can be disruptive
Availability Zones	Create matching workload-tier subnets in multiple AZs	Supports high availability and failure isolation
Public workloads	Use a public route table with an Internet Gateway route	Provides internet routing; access still requires IP and security controls
Private workloads	Use private route tables and controlled egress, such as NAT Gateway where required	Avoids direct inbound internet exposure
Application tiers	Separate presentation, application, and data tiers when isolation is required	Enables distinct routing, security, and operational controls
Future VPC connectivity	Reserve non-overlapping ranges before creating additional VPCs	Prevents later address conflicts

Exam-Relevant Takeaways

An IPv4 VPC CIDR block must be between /16 and /28.
The primary VPC CIDR block cannot be resized after creation.
AWS reserves five IPv4 addresses in every subnet.
A /24 has 256 total addresses and 251 usable addresses in AWS.
A /16 divided into /24 subnets produces 256 subnets.
Subnets are scoped to a single Availability Zone.
A public subnet requires a route to an Internet Gateway, but public IP addressing and security rules are also needed for internet reachability.
Avoid overlapping address ranges across VPCs and connected networks, even if the VPCs do not currently need connectivity.
Additional CIDR blocks may be associated with a VPC, but this is not the same as resizing the original CIDR block.
CIDR planning must include growth, multi-AZ deployment, service-created network interfaces, and future network integration.

Common Exam Traps

Confusing total and usable addresses: A /24 is not 254 usable addresses in an AWS subnet; AWS reserves five, leaving 251.
Assuming VPC CIDRs can be edited: The original VPC CIDR cannot simply be made larger or smaller after creation.
Treating every CIDR overlap as an immediate creation failure: Overlapping VPC ranges may exist independently, but they prevent or complicate private routing between those networks.
Assuming a public IP makes a subnet public: Public routing depends on the subnet route table and Internet Gateway path.
Putting all subnets in one AZ: Multiple subnets in one AZ do not provide multi-AZ resilience.
Using the same range for every VPC: This can make future peering, Transit Gateway, VPN, or Direct Connect integration impossible without redesign.
Counting only EC2 instances: Load balancers, container tasks, managed services, VPC endpoints, and other resources may consume private IP addresses.
Confusing a subnet mask with the number of hosts: A longer prefix, such as /24 compared with /16, creates smaller networks with fewer host addresses.

Real-World Engineer Notes

Establish an organization-wide IP address management process before creating multiple VPCs.
Reserve address space for development, staging, production, shared services, inspection, and disaster recovery environments.
Consider hybrid connectivity even if the initial deployment is cloud-only. On-premises networks commonly use large private ranges that can conflict with an ad hoc VPC design.
Keep subnet sizing consistent across Availability Zones where possible. Symmetric ranges simplify automation, routing, monitoring, and troubleshooting.
Do not allocate every possible address immediately. A large VPC with appropriately sized subnets provides flexibility, but unnecessarily oversized subnets can make segmentation and IP governance harder.
Separate route tables by trust boundary and traffic pattern rather than assuming every subnet should use the main route table.
Use subnet planning tools or IPAM solutions to calculate ranges and document allocations. Amazon VPC IP Address Manager (VPC IPAM) can help manage address space across accounts and Regions.
If a subnet becomes too small, the usual solution is to create a new, larger subnet and migrate resources where supported. This is why growth planning is preferable to relying on later remediation.

Quick Reference Summary

Recommended address families: RFC 1918 private IPv4 ranges.
VPC IPv4 CIDR size: /16 through /28.
Example VPC: 10.0.0.0/16.
Example subnet: 10.0.1.0/24.
Addresses in a /24: 256 total, 251 usable in AWS.
Subnets from 10.0.0.0/16 using /24: 256.
AWS subnet reservation: Five IPv4 addresses per subnet.
Public subnet: Route table includes a route to an Internet Gateway.
High availability: Deploy equivalent subnets across multiple AZs.
Critical planning rule: Avoid overlapping ranges with any network that may need private connectivity.

Flashcards

Q: What is the allowed size range for an IPv4 VPC CIDR block?

A: Between /16 and /28.

Q: Can the primary VPC CIDR block be resized after VPC creation?

A: No. Additional CIDR blocks may be associated, but the original block cannot be resized in place.

Q: Which private IPv4 ranges are defined by RFC 1918?

A: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.

Q: How many addresses are in a /24 subnet?

A: 256 total addresses.

Q: How many IPv4 addresses are usable in an AWS /24 subnet?

A: 251, because AWS reserves five addresses.

Q: How many /24 subnets fit inside a /16?

A: 256.

Q: What makes a subnet public?

A: Its route table has a route to an Internet Gateway.

Q: Does a public subnet automatically expose every instance to the internet?

A: No. The instance also needs suitable IP addressing and permissive security controls.

Q: Why should VPC CIDRs avoid overlap with other VPCs?

A: Overlap prevents or complicates private routing through services such as VPC peering, Transit Gateway, VPN, and Direct Connect.

Q: Can a subnet span multiple Availability Zones?

A: No. Each subnet belongs to one Availability Zone.

Q: What happens when a /16 is divided into /24 networks?

A: Eight host bits are borrowed, creating 256 /24 subnets.

Q: Which capacity factors should be included in subnet planning?

A: Workload growth, multi-AZ deployment, scaling, AWS-managed interfaces, VPC endpoints, and future connectivity requirements.

Practice Questions

Question 1

A company is designing a new production VPC that may later connect to several existing VPCs and an on-premises data center. Which approach best reduces future connectivity risk?

A. Use the same 10.0.0.0/16 range in every VPC for consistency.
B. Select a private CIDR range after reviewing all existing and planned network ranges.
C. Use a public IPv4 range so that overlap is not possible.
D. Create the VPC with a /28 and add ranges only when required.

Correct answer: B

Explanation: Non-overlapping private ranges are essential for predictable routing across VPC peering, Transit Gateway, VPN, and Direct Connect. Public ranges are not a substitute for proper private address planning, and a /28 is unlikely to provide adequate growth capacity.

Question 2

An architect creates a 10.20.0.0/16 VPC and divides it into /24 subnets. How many /24 subnets can be created, and how many IPv4 addresses are usable in each subnet?

A. 16 subnets and 4,091 usable addresses each
B. 128 subnets and 251 usable addresses each
C. 256 subnets and 251 usable addresses each
D. 256 subnets and 254 usable addresses each

Correct answer: C

Explanation: Moving from /16 to /24 borrows eight bits, producing 2^8, or 256, subnets. Each /24 contains 256 addresses, and AWS reserves five, leaving 251 usable IPv4 addresses.

Question 3

An EC2 instance in a subnet has a public IPv4 address, but it cannot reach the internet. The security group allows outbound traffic. Which configuration should be checked first?

A. Whether the subnet route table has a default route to an Internet Gateway
B. Whether the VPC CIDR is /16 rather than /24
C. Whether the subnet contains at least 256 instances
D. Whether the VPC has an additional CIDR block

Correct answer: A

Explanation: A public IPv4 address alone is insufficient. The subnet route table must direct internet-bound traffic to an Internet Gateway, and network ACLs and instance configuration must also permit the traffic.

Question 4

A VPC is running out of addresses in one application subnet. The architect wants to increase that subnet’s CIDR size without disrupting existing resources. What is the best conclusion?

A. Change the subnet from /24 to /23 in place.
B. Change the VPC’s primary CIDR from /16 to /15.
C. Create a new appropriately sized subnet and migrate or scale resources into it.
D. Remove the five AWS-reserved addresses.

Correct answer: C

Explanation: Existing VPC and subnet CIDR ranges cannot simply be resized in place. A new subnet, or in some cases an additional VPC CIDR followed by a new subnet, is the normal remediation path. AWS-reserved addresses cannot be reclaimed.

Question 5

A team creates public and private subnets in two Availability Zones. Which statement is accurate?

A. Both subnet types must use the same route table for consistent routing.
B. A subnet is public because it assigns public IP addresses automatically.
C. The public subnets should have a route to an Internet Gateway, while private subnets should use separate routing appropriate to their traffic needs.
D. A subnet can be associated with multiple Availability Zones to simplify the design.

Correct answer: C

Explanation: Public and private subnets commonly use distinct route tables. Public subnets route internet traffic through an Internet Gateway, while private subnets avoid direct inbound internet routing and may use controlled egress such as a NAT Gateway. Each subnet is associated with a single Availability Zone.