Plan AWS VPC and subnet CIDR blocks accounting for AWS-reserved addresses.
AWS VPCs support CIDR blocks from /16 (65,536 addresses) down to /28 (16 addresses). Within a VPC, each subnet reserves exactly 5 IP addresses that are not available for use: the network address, the VPC router address, the DNS server address, a reserved address for future use, and the broadcast address (which VPCs don't support but AWS still reserves) — so a /24 subnet's 256 addresses yield only 251 usable IPs. Dividing the VPC's total address space by the chosen subnet size gives the maximum number of same-sized subnets it can hold, which is then typically spread evenly across availability zones for high availability.
Usable IPs per subnet
usable = 2^(32 − subnet_prefix) − 5
Max subnets in VPC
max_subnets = 2^(32 − vpc_prefix) / 2^(32 − subnet_prefix)
Standard IPv4 subnetting reserves 2 addresses (network + broadcast). AWS adds 3 more for VPC-specific infrastructure: the VPC router (second address), the Amazon-provided DNS server (second-to-last address), and a reserved address for future use (third-to-last) — even though VPCs don't actually broadcast.
AWS VPCs support CIDR blocks from /16 (65,536 total addresses) as the largest down to /28 (16 total addresses, 11 usable after reservations) as the smallest.
Distributing subnets (and the resources within them) across multiple AZs protects against a single data-center-level failure taking down an entire application — AWS best practice is to place otherwise-identical subnets in at least two, often three, AZs for critical workloads.
AWS allows adding secondary CIDR blocks to an existing VPC, but the primary CIDR block cannot be changed after creation — this calculator is best used during initial planning to avoid needing secondary blocks later.