Work out usable IPs per AWS subnet after the five reserved addresses, and check a multi-AZ, multi-tier layout fits the VPC.
Every AWS subnet loses five addresses to the network address, the VPC router, the Amazon-provided DNS server, a reserved future-use address and the broadcast address, so a /24 gives 251 usable IPs rather than 254. Because a subnet lives in exactly one Availability Zone, the subnet count is zones multiplied by tiers, and that product has to fit inside the subnet slots the VPC prefix provides. Subnets cannot be resized after creation, and an ENI-hungry workload such as EKS with the VPC CNI can exhaust a /24 far sooner than the raw address count suggests.
AWS Subnet
usable IPs = 2^(32 − subnet prefix) − 5; subnets required = zones × tiers; subnets available = 2^(subnet prefix − VPC prefix).
usable IPs = 2^(32 − subnet prefix) − 5; subnets required = zones × tiers; subnets available = 2^(subnet prefix − VPC prefix). Every AWS subnet loses five addresses to the network address, the VPC router, the Amazon-provided DNS server, a reserved future-use address and the broadcast address, so a /24 gives 251 usable IPs rather than 254. Because a subnet lives in exactly one Availability Zone, the subnet count is zones multiplied by tiers, and that product has to fit inside the subnet slots the VPC prefix provides.
Subnets cannot be resized after creation, and an ENI-hungry workload such as EKS with the VPC CNI can exhaust a /24 far sooner than the raw address count suggests.
This calculator takes 4 inputs: VPC CIDR prefix length, Subnet prefix length, Availability Zones in use, Subnet tiers per zone. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
On top of the usual network and broadcast addresses, AWS reserves the second address for the VPC router, the third for the Amazon DNS resolver, and the fourth for future use. That is why the smallest allowed subnet, a /28, offers 11 usable addresses out of 16.
Create one subnet per zone per distinct routing behaviour. A public tier with a route to the internet gateway, a private tier routed through NAT, and an isolated data tier is the common three-tier pattern — extra subnets that share a route table add management overhead without adding isolation.