VPC, Subnets and the Five Reserved Addresses

By the end of this lesson you will be able to

• Explain what a VPC is, what it isolates, and why it belongs to exactly one Region.
• State the VPC limits that the exam tests: CIDR sizes, secondary blocks, VPCs per Region.
• Explain how subnets relate to Availability Zones, and lay out subnets so an application survives the loss of a whole AZ.
• Name the five addresses AWS reserves in every subnet and size a subnet correctly for a given number of instances.
• Describe exactly what the default VPC gives you, how to recover it, and why production should not use it.

#What a VPC is

A VPC (Virtual Private Cloud) is your own private, logically isolated network inside AWS. Physically, your servers share AWS data centres and cables with millions of other customers; logically, a VPC behaves like a separate network that only you can see. Nothing from another customer, and nothing from the internet, can reach a resource inside your VPC unless you deliberately open a way in.

Inside a VPC you decide:

• the address range (a CIDR block, lesson 3.1);
• how it is split into subnets, and in which data centres each subnet lives;
• where traffic may go, with route tables (lesson 3.3);
• what is allowed in and out, with security groups and network ACLs (lesson 3.5);
• how it connects to the internet, to your office, or to other VPCs (lessons 3.3–3.4 and Chapter 22).

#The rules of a VPC

These limits appear in exam questions as scenario details, so learn them as facts:

#Subnets and Availability Zones

A subnet is a slice of the VPC’s range, for example 10.0.10.0/24 out of 10.0.0.0/16. Every resource that has an address in the VPC (an EC2 instance, a database, a load balancer node) lives in a subnet.

Two facts about subnets matter more than anything else:

1. A subnet lives in exactly one Availability Zone. An Availability Zone (AZ) is one or more data centres with independent power, cooling and networking, separated from the other AZs of the Region by a meaningful distance and connected to them by fast, low-latency private links. Every Region has at least three. A VPC spans all of them, but each subnet is pinned to one.
2. “Public” and “private” are not settings on the subnet. A subnet is public if its route table sends internet traffic to an internet gateway, and private if it does not. Lesson 3.3 shows exactly how.

Because a subnet cannot span AZs, high availability is built by repeating the same layout in two or more AZs: a public subnet and a private subnet in AZ A, the same pair in AZ B, and one copy of each tier in each. If one AZ fails, the copies in the other AZ keep the application running.

A common production layout uses three tiers in each AZ:

#The five reserved addresses

In every subnet, AWS keeps five addresses for itself: the first four and the last one. You can never assign them to an instance. For 10.0.0.0/24:

So usable addresses = total − 5:

#Leave room to grow

Instances are not the only things that use subnet addresses. Plan for:

• Load balancers: each load balancer node takes addresses in its subnets, and an Application Load Balancer needs subnets of at least /27 with at least 8 free addresses so it can scale.
• Containers and Lambda: with modern networking every container task, and every VPC-connected Lambda network interface, takes its own address. A busy Kubernetes cluster can exhaust a /24 quickly.
• Rolling deployments and Auto Scaling: during a deployment the old and new instances run side by side, briefly doubling the count.

A subnet cannot be resized after creation. When in doubt, choose a bigger subnet or leave space in the VPC range for new ones.

#The default VPC

Every AWS account comes with a default VPC in every Region, so you can launch an instance in seconds without any networking knowledge. It is useful for learning, and it is exactly what a careless launch ends up in.

What the default VPC contains:

• CIDR 172.31.0.0/16, the same in every Region and every account.
• One default subnet per AZ, each a /20 (4,096 addresses).
• Every default subnet is public: an internet gateway is attached, the main route table sends 0.0.0.0/0 to it, and auto-assign public IPv4 is turned on. A new instance gets a public address automatically.
• A default network ACL that allows all traffic in and out.
• A default security group that allows all outbound traffic and allows inbound traffic only from other members of the same security group. It does not allow traffic from the internet.

If the default VPC is deleted, you cannot restore it from a backup, but you can recreate it: in the VPC console choose Actions → Create default VPC, or run aws ec2 create-default-vpc. AWS rebuilds it with the same layout.

#Try it yourself

With the AWS CLI configured (any Region; these resources are free while they hold nothing that costs money):

# Which AZs does this Region have, and what are their IDs?
aws ec2 describe-availability-zones --query "AvailabilityZones[].[ZoneName,ZoneId]" --output table

# Create a VPC and two subnets in different AZs
VPC=$(aws ec2 create-vpc --cidr-block 10.0.0.0/16 --query Vpc.VpcId --output text)
aws ec2 create-subnet --vpc-id $VPC --cidr-block 10.0.0.0/24  --availability-zone-id apse1-az1
aws ec2 create-subnet --vpc-id $VPC --cidr-block 10.0.10.0/24 --availability-zone-id apse1-az2

# Add a secondary CIDR block
aws ec2 associate-vpc-cidr-block --vpc-id $VPC --cidr-block 10.1.0.0/16

# How many addresses are still free in each subnet?
aws ec2 describe-subnets --filters Name=vpc-id,Values=$VPC \
  --query "Subnets[].[CidrBlock,AvailabilityZone,AvailableIpAddressCount]" --output table

The last command shows 251 free addresses in each new /24, not 256: the five reserved ones are already subtracted. Replace the AZ IDs with ones from the first command if your Region differs. Delete the subnets and the VPC when you are done.

#Summary

Key takeaways

• A VPC is a logically isolated private network in one Region, available in every AZ of that Region. Nothing gets in or out unless you add a path.
• VPC CIDR blocks are /16 to /28. The primary block cannot change; add secondary blocks (5 per VPC by default) for more space. Default quota: 5 VPCs per Region.
• A subnet is a slice of the VPC range in exactly one AZ. High availability = the same subnet layout in at least two AZs, one copy of each tier per AZ.
• Public vs private is decided by the route table, not by a subnet setting.
• AWS reserves 5 addresses per subnet (first four + last): network, VPC router, DNS, future use, broadcast. Usable = total − 5: /28 = 11, /27 = 27, /26 = 59, /24 = 251.
• The default VPC (172.31.0.0/16, a public /20 per AZ, internet gateway, auto-assign public IP) exists in every Region; recreate it with “Create default VPC”. Use a custom VPC for production.

Self-check: VPCs and subnets30 questions