Dividing the Pie
When you create a VPC, you give it a block of IP addresses using CIDR notation (Classless Inter-Domain Routing), which looks like 10.0.0.0/16. CIDR is just a compact way of expressing both a network address and how large that network is, in a single string.
Think of this block as a large plot of land. You can't hand the entire plot to one tenant — you divide it into parcels. In networking, those parcels are called subnets. You generally divide your VPC into two categories:
- Public Subnets: Resources here can be reached from the internet (e.g., load balancers, bastion hosts).
- Private Subnets: Resources here are hidden from the internet (e.g., application servers, databases).
Understanding the "Slash" (/xx)
An IPv4 address is 32 bits long (e.g., 10.0.1.0 in binary is 32 ones and zeros). The /xx in CIDR notation tells you how many of those 32 bits are "fixed" to identify the network itself. The remaining bits are free to assign to individual hosts (servers, databases, etc.).
The golden rule of CIDR math:
Every time you increase the slash number by 1, you cut the number of available IP addresses in half.
| CIDR | Host Bits | Total IPs | Usable IPs (AWS reserves 5) |
|---|---|---|---|
| /16 | 16 | 65,536 | 65,531 |
| /24 | 8 | 256 | 251 |
| /25 | 7 | 128 | 123 |
| /26 | 6 | 64 | 59 |
| /28 | 4 | 16 | 11 |
The /24 is the most common subnet size in practice — large enough to hold plenty of resources, small enough to keep your IP space organized. The /16 is typically used for the VPC itself, giving you room to carve out many /24 subnets inside it.
IP Planning Matters More Than You Think
A common mistake is creating a VPC with a small CIDR block (like /24) and then running out of IP addresses as the application grows. You cannot resize a VPC's CIDR block after creation without significant effort. Plan generously upfront. A /16 VPC costs nothing extra and gives you 65,000+ addresses to work with.
Also consider: if you ever need to peer two VPCs (connect them together), their CIDR ranges must not overlap. If VPC A is 10.0.0.0/16 and VPC B is also 10.0.0.0/16, peering is impossible. Use non-overlapping ranges from the start — for example, 10.0.0.0/16 for production and 10.1.0.0/16 for staging.