AWS subnets are the fundamental building blocks for network segmentation inside an Amazon Virtual Private Cloud. A subnet is a slice of a VPC’s IP address space, locked to a single Availability Zone. Resources cannot be launched directly into a VPC; they are always launched into a subnet. The classification of a subnet as public, private, or isolated is not a fixed property of the subnet itself. The classification is determined entirely by the route table attached to the subnet and whether that route table points to an Internet Gateway.
Subnet Fundamentals in AWS VPC
A subnet is a range of IP addresses in a VPC. You can create AWS resources such as EC2 instances in specific subnets. Each subnet must reside entirely within one Availability Zone and cannot span zones. By launching AWS resources in separate Availability Zones, you can protect applications from the failure of a single Availability Zone.
Subnets in AWS are sections of an Amazon Virtual Private Cloud network. They enable you to divide the IP address space in your VPC into smaller, more manageable blocks. For organizing resources, controlling network traffic, and ensuring high availability within AWS infrastructure, it is essential to comprehend and configure subnets appropriately.
Each subnet is related with a particular range of IPv4 addresses within the CIDR block of the VPC. Subnets are identified by their CIDR notation, which indicates the range of IP addresses allocated to the subnet.
A VPC is a private network in the cloud. It gives full access over the networking environment allowing you to define your IP address range also to create subnets and manage routing tables. With VPC you can securely connect your resources to the internet or keep them isolated from external traffic depending on your needs. It is like building your own private data center within AWS.
Subnet Types Determined by Routing
The subnet type is determined by how you configure routing for your subnets.
Public subnet: route table has a 0.0.0.0/0 route to an Internet Gateway. Resources in public subnets can be accessed from the internet such as web servers. Public subnets will be subnets inside a VPC that have route to the web through an internet gateway.
Private subnet: no Internet Gateway route; outbound internet goes via a NAT Gateway. Resources within private subnets cannot be accessed from outside the VPC unless specific configurations are made. Private subnets do not have a direct route to the internet it uses NAT device to get connected with Internet.
Isolated subnet: no internet access in any direction, not even through a NAT Gateway.
VPN-Only subnets have access to the VPN connection ideal for resources that need secure communication with on-premises data centers.
In a typical production app, your load balancer lives in a public subnet, your app servers in a private subnet, and your database in an isolated subnet. Everything connects internally, but only the load balancer is reachable from the internet.
Whether that subnet is public or private is not a fixed property. It is entirely determined by the route table attached to it. Change the route table, and the subnet changes type instantly.
Building analogy: A VPC is a private office building. You divide it into rooms, subnets, each on one floor, one Availability Zone.
Route Tables, Gateways and Traffic Control
Every subnet is linked to a route table that defines the outbound traffic routes it can take. By default, all subnets are connected to the main route table of the VPC. However, you have the flexibility to modify this association and customize the main route table as needed.
Route Tables control the routing for subnet traffic. You define routing rules that figure out where organization traffic is coordinated.
Gateway for Internet, IGW, allows resources in your VPC to connect to the internet as well as resources in the VPC to connect to the internet.
Instances within a subnet can communicate with each other, and you can control over traffic stream between subnets.
Network Access Control Lists and Security Groups are security components that control traffic to and from instances. Security groups are stateful, while NACLs are stateless.
Elastic IP Address is an IPv4 static address that can be assigned to AWS resources within your VPC, such as EC2 instances.
IP Addressing and CIDR Blocks
When you create a subnet, you specify its IP addresses, depending on the configuration of the VPC:
- IPv4 only – The subnet has an IPv4 CIDR block but does not have an IPv6 CIDR block. Resources in an IPv4-only subnet must communicate over IPv4.
- Dual stack – The subnet has both an IPv4 CIDR block and an IPv6 CIDR block. The VPC must have both an IPv4 CIDR block and an IPv6 CIDR block. Resources in a dual-stack subnet can communicate over IPv4 and IPv6.
- IPv6 only – The subnet has an IPv6 CIDR block but does not have an IPv4 CIDR block. The VPC must have an IPv6 CIDR block. Resources in an IPv6-only subnet must communicate over IPv6.
Resources in IPv6-only subnets are assigned IPv4 link-local addresses from CIDR block 169.254.0.0/16. These addresses are used to communicate with services that are available only in the VPC.
Each subnet has a configurable setting that determines whether a network interface created within it will receive a public IPv4 address or an IPv6 address.
IP Reservation and Usable Capacity
Every AWS subnet blocks five IP addresses. This reduces usable capacity, especially on small subnets like /28 or /29. The calculator highlights those addresses so you can plan realistic host counts.
AWS uses them for network, routing, DNS, future growth, and broadcast. They are not usable by your instances.
The label is for organization only. AWS reservation rules are the same for all subnets. Does public/private selection change the math? No.
The smallest usable AWS subnet is /28, which yields 16 IPs total and 11 usable after reservations.
Example subnet splits can be visualized:
| Availability Zone | Subnet CIDR | First Usable IP | Last Usable IP |
|---|---|---|---|
| us-east-1a | 10.0.0.0/24 | 10.0.0.4 | 10.0.0.254 |
| us-east-1b | 10.0.64.0/24 | 10.0.64.4 | 10.0.127.254 |
| us-east-1c | 10.0.128.0/24 | 10.0.128.4 | 10.0.191.254 |
| us-east-1a | 10.0.192.0/24 | 10.0.192.4 | 10.0.255.254 |
Planning examples include:
- Split a /16 into /20 subnets for regional isolation.
- Compare /24 vs /26 usable IPs for private workloads.
- Plan public subnets with enough space for NAT and load balancers.
Subnet Planning and Tools
Plan and visualize AWS VPC subnets with advanced features.
Use a single route table for all public subnets
Use a single route table for all private subnets
Enable Transit Gateway for multi-account VPC access
Add tags to route tables for better organization
Required for public subnets to access the internet
Allows private subnets to access the internet, requires both public and private subnets
Creates a NAT Gateway in each AZ for high availability
Allocate Elastic IPs for NAT Gateways
Adds a gateway endpoint for Amazon S3
Adds a gateway endpoint for Amazon DynamoDB
Plan your VPC subnets across multiple availability zones with custom CIDR blocks
Visualize your subnet allocation and network topology with interactive diagrams
Generate Terraform and CloudFormation code for your subnet configuration
Export your subnet plan as JSON, CSV, or infrastructure code
Use our AWS Subnet Calculator to plan your infrastructure efficiently
The tools help plan infrastructure efficiently with new features to help plan AWS VPC subnets more efficiently.
Practical Configuration Steps
AWS VPC helps to create a private-cloud like computing environment inside the shared public cloud infrastructure.
Understanding the AWS Virtual Private Cloud is foundational. Amazon web service is designed to help organizations and application providers to easily and securely host their applications. The basic security level that every organization follows is to form their own network, which is Virtual Network or also termed as Virtual Private Cloud.
VPC helps to create a private-cloud like computing environment inside the shared public cloud infrastructure.
Step-by-step procedure for creating a VPC involves understanding IP Address and CIDR Blocks, Deep Dive into Subnets, Public Subnet, Private Subnet, Router and Internet Gateway, Subnet Masks, Subnet Types, Subnet Routing, Subnet Settings, AWS VPC and Subnet Security.
Subnet Security Considerations
AWS VPC and Subnet Security must be considered when designing.
Security components control traffic to and from instances. Security groups are stateful, while NACLs are stateless.
Isolated subnets provide no internet access in any direction, not even through a NAT Gateway.
Private subnets provide outbound internet via NAT Gateway but no direct inbound internet.
Public subnets provide internet access via Internet Gateway.
This structure ensures clear communication within the network and facilitates resource management.
Conclusion
Subnet design in AWS is a routing decision, not a creation-time attribute. A subnet is a named chunk of IP address space inside a VPC, each pinned to one Availability Zone. Public, private, isolated, and VPN-only behavior emerges from the route table attached to the subnet and the presence of an Internet Gateway or NAT Gateway.
IP planning must account for the five reserved addresses per subnet. The smallest usable subnet is /28 with 11 usable IPs. IPv4 only, dual stack, and IPv6 only options change addressing behavior but do not change reservation rules.
Production patterns place load balancers in public subnets, application servers in private subnets, and databases in isolated subnets. High availability is achieved by spreading subnets across Availability Zones and using separate route tables per subnet type.
Effective subnet planning combines CIDR sizing, Availability Zone distribution, route table association, and gateway selection. Tools that visualize subnet allocation and generate Terraform or CloudFormation code reduce errors when scaling VPCs across multiple accounts.