# Carving and Sizing Subnets — Cloud Networking: VPCs, Subnets & Peering

Source: https://www.skillbyai.com/en/cloud-networking/cn-subnet-sizing

> Split a VPC into per-tier, per-AZ subnets and account for the addresses the provider reserves.

## Subnets per tier, per zone, with headroom

A typical design gives every tier its own subnet in every AZ: three tiers across three AZs means nine subnets. Subnets in one VPC must not overlap, and in AWS each must be between `/16` and `/28`. Remember that the provider keeps a few addresses for itself. AWS reserves **five** addresses in every subnet: the network address, the next three (VPC router, DNS, future use) and the last address. Azure also reserves five, and Google Cloud reserves four in each primary range. So a `/28` in AWS gives you 11 usable IPs, not 16. Size subnets for the busiest future, not today: load balancers, managed databases, Lambda functions in a VPC and Kubernetes pods may each consume addresses. A common pattern is to leave unallocated space in the VPC so you can add new subnets later without renumbering. It is far easier to start with `/20` subnets than to migrate a full `/24`.

## Generating a nine-subnet layout

`subnets(new_prefix=20)` yields consecutive /20 blocks; we hand them out per tier and per AZ and subtract the five reserved addresses. Seven /20 blocks remain free for future tiers.

```python
import ipaddress

vpc = ipaddress.ip_network("10.0.0.0/16")
azs = ["ap-south-1a", "ap-south-1b", "ap-south-1c"]
blocks = vpc.subnets(new_prefix=20)  # 16 blocks of 4,096 addresses

for tier in ["public", "private-app", "private-db"]:
    for az in azs:
        net = next(blocks)
        usable = net.num_addresses - 5  # AWS reserves 5 per subnet
        print(f"{tier:<12} {az}  {str(net):<15} usable={usable}")
```

Output:

```
public       ap-south-1a  10.0.0.0/20     usable=4091
public       ap-south-1b  10.0.16.0/20    usable=4091
public       ap-south-1c  10.0.32.0/20    usable=4091
private-app  ap-south-1a  10.0.48.0/20    usable=4091
private-app  ap-south-1b  10.0.64.0/20    usable=4091
private-app  ap-south-1c  10.0.80.0/20    usable=4091
private-db   ap-south-1a  10.0.96.0/20    usable=4091
private-db   ap-south-1b  10.0.112.0/20   usable=4091
private-db   ap-south-1c  10.0.128.0/20   usable=4091
```

## Interview trap: usable hosts

If asked how many instances fit in an AWS /24 subnet, the answer is 251 (256 minus 5 reserved), not 254 as in classic on-premises networking.

**Quiz:** How many usable IP addresses does an AWS subnet with a /27 prefix provide?

- [ ] 32
- [ ] 30
- [x] 27
- [ ] 16

*Answer:* 27. A /27 has 32 addresses. AWS reserves 5, leaving 27 usable.