Carving and Sizing Subnets

Subnets per tier, per zone, with headroom

A typical design gives every tier its own subnet in every AZ: three tiers across three AZs means nine subnets. Subnets in one VPC must not overlap, and in AWS each must be between /16 and /28. Remember that the provider keeps a few addresses for itself. AWS reserves five addresses in every subnet: the network address, the next three (VPC router, DNS, future use) and the last address. Azure also reserves five, and Google Cloud reserves four in each primary range. So a /28 in AWS gives you 11 usable IPs, not 16. Size subnets for the busiest future, not today: load balancers, managed databases, Lambda functions in a VPC and Kubernetes pods may each consume addresses. A common pattern is to leave unallocated space in the VPC so you can add new subnets later without renumbering. It is far easier to start with /20 subnets than to migrate a full /24.

Generating a nine-subnet layout

subnets(new_prefix=20) yields consecutive /20 blocks; we hand them out per tier and per AZ and subtract the five reserved addresses. Seven /20 blocks remain free for future tiers.

import ipaddress

vpc = ipaddress.ip_network("10.0.0.0/16")
azs = ["ap-south-1a", "ap-south-1b", "ap-south-1c"]
blocks = vpc.subnets(new_prefix=20)  # 16 blocks of 4,096 addresses

for tier in ["public", "private-app", "private-db"]:
    for az in azs:
        net = next(blocks)
        usable = net.num_addresses - 5  # AWS reserves 5 per subnet
        print(f"{tier:<12} {az}  {str(net):<15} usable={usable}")

Output:

public       ap-south-1a  10.0.0.0/20     usable=4091
public       ap-south-1b  10.0.16.0/20    usable=4091
public       ap-south-1c  10.0.32.0/20    usable=4091
private-app  ap-south-1a  10.0.48.0/20    usable=4091
private-app  ap-south-1b  10.0.64.0/20    usable=4091
private-app  ap-south-1c  10.0.80.0/20    usable=4091
private-db   ap-south-1a  10.0.96.0/20    usable=4091
private-db   ap-south-1b  10.0.112.0/20   usable=4091
private-db   ap-south-1c  10.0.128.0/20   usable=4091

Interview trap: usable hosts

If asked how many instances fit in an AWS /24 subnet, the answer is 251 (256 minus 5 reserved), not 254 as in classic on-premises networking.

त्वरित जाँच: How many usable IP addresses does an AWS subnet with a /27 prefix provide?

• 32
• 30
• 27
• 16