title: “VPC Subnets” created: 2026-07-22 updated: 2026-07-22 type: knowledge tags:
- aws
- certification
- networking
- vpc
VPC Subnets
What It Is
A Subnet is a range of IP addresses within a VPC. It represents a segment of the VPC’s CIDR block and exists in exactly one Availability Zone.
Why It Matters
Subnets are where your resources actually live. The distinction between public and private subnets is fundamental to AWS network security architecture and heavily tested on certification exams.
Key Concepts
Subnet Properties
- Belongs to a single VPC
- Exists in a single Availability Zone (cannot span AZs)
- Has a CIDR block that is a subset of the VPC’s CIDR
- Has an associated Route Table (determines public vs private)
- Has an associated Network ACL
Public vs Private Subnets
| Aspect | Public Subnet | Private Subnet |
|---|---|---|
| Route to IGW | Yes (0.0.0.0/0 → igw-xxx) | No |
| Route to NAT | Optional | Yes (0.0.0.0/0 → nat-xxx) |
| Direct Internet access | Yes (with public IP) | No |
| Inbound from Internet | Possible | Not possible |
| Typical resources | Load balancers, bastion hosts, NAT GW | App servers, databases, internal services |
Key insight: What makes a subnet public or private is purely its route table — specifically whether it has a route to an Internet Gateway.
Reserved IP Addresses
AWS reserves 5 IP addresses in every subnet:
| Address | Purpose |
|---|---|
First (.0) | Network address |
Second (.1) | VPC router |
Third (.2) | DNS server |
Fourth (.3) | Reserved for future use |
Last (.255) | Broadcast (not used but reserved) |
A /24 subnet (256 IPs) has 251 usable addresses.
Example Layout
VPC: 10.0.0.0/16
├── Public subnet: 10.0.25.0/24 (AZ-a) → 251 usable IPs
├── Private subnet: 10.0.50.0/24 (AZ-a) → 251 usable IPs
└── ... room for more subnets in other AZs
Gotchas
- Subnet CIDR blocks cannot overlap within the same VPC
- A subnet cannot span multiple AZs — for HA you need one subnet per AZ
- The default VPC has a public subnet in each AZ (auto-assigns public IPs)
- Custom VPCs do not auto-assign public IPs — you must enable it per subnet or per instance
See Also
- [[vpc-fundamentals]]
- [[vpc-route-tables]]
- [[vpc-internet-gateway]]
- [[vpc-nat-gateway]]
- [[cidr-notation]]