AWS Cloud Practitioner Study Notes · Part 22

CIDR Blocks in AWS: VPC Design, Planning, and Security Rules

AWS Cloud Practitioner study notes explaining CIDR prefixes, VPC design, subnet planning, address counts, /32 rules, and 0.0.0.0/0.

Tan Chin SiangBackend & Cloud Software Engineer

20 Aug 2026 9 min read

AWS networking rarely asks you to list every IP address one by one. Instead, VPCs, subnets, route tables, security groups, and network ACLs use CIDR blocks to describe ranges compactly.

This is Part 22 of the AWS Cloud Practitioner Study Notes series. Part 21 introduced IP addresses and subnet reservations; this note focuses on reading and applying CIDR notation.

What is CIDR?

CIDR stands for Classless Inter-Domain Routing. It represents an IP network as an address followed by a prefix length:

192.168.1.0/24

The prefix length tells you how many leading bits identify the network. The remaining bits identify addresses inside that network.

An apartment-building analogy is useful. Instead of writing every room individually, you can identify the whole building. CIDR does the same thing for IP addresses: one notation describes a complete range.

Reading CIDR notation

Consider:

10.0.0.0/16

10.0.0.0 is the network address.
/16 is the prefix length.
16 bits identify the network.
The remaining 16 bits identify addresses within the block.
The block contains 2^(32 - 16) = 65,536 IPv4 addresses.

For IPv4, the prefix length can range from /0 to /32:

/0 matches every IPv4 address.
/32 matches exactly one IPv4 address.

The larger the prefix number, the smaller the address block. A /28 is smaller than a /24, and a /24 is smaller than a /16.

Common IPv4 CIDR blocks

CIDR	Host bits	Total IPv4 addresses	Typical use
`/32`	0	1	One host or source IP
`/30`	2	4	Small point-to-point range
`/28`	4	16	Small AWS subnet
`/24`	8	256	Small network or subnet
`/16`	16	65,536	Common VPC size
`/8`	24	16,777,216	Very large private network
`/0`	32	4,294,967,296	Every IPv4 address

The calculation is:

Total addresses = 2^(32 - prefix length)

For example, a /24 leaves 8 host bits:

2^8 = 256 addresses

CIDR range examples

`/32`: one specific address

192.168.1.10/32

This matches only 192.168.1.10.

In an AWS security group, a /32 source can restrict SSH access to one public source address. For example, 203.0.113.10/32 is a documentation-only example; in a real rule, replace it with the administrator’s actual public IP address or approved corporate range.

`/24`: 256 addresses

192.168.1.0/24

This covers:

192.168.1.0 – 192.168.1.255

The first address is the network address and the last address is the end of the block. In AWS, five addresses in every subnet are reserved, so a /24 AWS subnet has 251 addresses available for resources rather than 256. See Part 21 for the reservation details.

`/16`: a large VPC range

10.0.0.0/16

This covers:

10.0.0.0 – 10.0.255.255

It contains 65,536 IPv4 addresses before AWS subnet reservations. A VPC might use this range and divide it into smaller non-overlapping subnets.

CIDR in an AWS VPC

When you create an AWS VPC, you assign it one or more CIDR blocks. Subnets then use smaller CIDR blocks from the VPC range.

Example:

AWS resource	CIDR block	Purpose
VPC	`10.0.0.0/16`	Overall private address space
Public subnet	`10.0.1.0/24`	Resources with an Internet-facing path
Private subnet	`10.0.2.0/24`	Resources without direct Internet exposure

The subnet ranges must fit inside the VPC’s address space and must not overlap. Overlapping ranges make routing ambiguous and create problems when connecting VPCs, on-premises networks, or other private environments.

AWS allows IPv4 VPC CIDR blocks from /16 through /28, subject to the relevant VPC rules and quotas. IPv4 subnet CIDR blocks also range from /16 through /28, although practical designs normally use smaller subnets inside a larger VPC.

VPC design and CIDR planning

Choosing a CIDR block is an architecture decision, not just a form field. A VPC that is too small can run out of addresses; a poorly chosen range can prevent future connectivity to offices, data centres, other VPCs, or acquired networks.

Plan the address space before creating the VPC:

List the networks that may need private connectivity, including on-premises ranges, other AWS accounts, development environments, production environments, VPN clients, and shared services.
Choose a VPC range large enough for expected workloads and future growth, while keeping it within the AWS-supported range.
Divide the VPC into non-overlapping CIDR blocks for workload tiers and Availability Zones.
Leave unallocated space for future subnets, new Availability Zones, migrations, and temporary environments.
Record the allocation in an IP address management system or a version-controlled network plan.

Example: planning a multi-AZ VPC

Suppose a production VPC uses 10.0.0.0/16 and spans three Availability Zones. Instead of putting every resource in one large subnet, reserve equal-sized ranges for each tier in each zone:

Tier	Availability Zone A	Availability Zone B	Availability Zone C
Public	`10.0.0.0/20`	`10.0.16.0/20`	`10.0.32.0/20`
Application	`10.0.64.0/20`	`10.0.80.0/20`	`10.0.96.0/20`
Data	`10.0.128.0/20`	`10.0.144.0/20`	`10.0.160.0/20`

Each /20 contains 4,096 IPv4 addresses before AWS’s five subnet reservations. The gaps between the ranges leave room for additional tiers, inspection subnets, endpoints, or future expansion. The exact sizes should be based on the expected number of network interfaces and the address requirements of the services in each subnet.

This layout also makes routing and security intent easier to understand:

Public subnets can contain Internet-facing load balancers or other resources that need a public route.
Application subnets can remain private and receive traffic from the public tier.
Data subnets can be isolated further and allow traffic only from approved application resources.
Each tier exists in multiple Availability Zones for resilience.

The labels “public” and “private” describe routing and exposure, not the CIDR itself. A subnet becomes public because its route table has a path to an Internet Gateway and its resources have appropriate public addressing; 10.0.0.0/20 is not inherently public or private based only on the number.

CIDR planning rules of thumb

Use a predictable structure for environments, Regions, Availability Zones, and workload tiers.
Do not reuse the same CIDR range across VPCs that may later need to communicate.
Keep VPC and on-premises CIDRs non-overlapping when using VPC peering, Transit Gateway, VPN, or Direct Connect.
Size subnets for peak expected network interfaces, not only today’s instances.
Keep spare ranges for future services, migrations, blue-green deployments, and temporary testing.
Separate production and non-production address pools so route and security policies remain clear.
Prefer private RFC 1918 space for ordinary VPC designs unless a documented requirement justifies another range.

AWS VPC IP Address Manager (IPAM) can organise contiguous CIDR pools by Region, environment, or routing and security need. It can allocate CIDRs to VPCs and subnets while helping teams monitor IP usage. IPAM is particularly useful when several accounts or teams create networks independently.

Overlapping CIDRs are a serious design constraint. VPC peering cannot connect VPCs with overlapping ranges, and Transit Gateway does not support routing between attached VPCs with identical or overlapping CIDRs. Planning the address space before deployment is usually much easier than renumbering a running environment later.

IPv6 planning

IPv6 uses a separate address family and does not replace IPv4 CIDR planning automatically. A dual-stack subnet needs both an IPv4 CIDR and an IPv6 CIDR, with separate routes and security rules. AWS commonly associates a /64 IPv6 CIDR with each subnet, while the VPC IPv6 range is larger.

Private IPv4 CIDR ranges

These RFC 1918 ranges are reserved for private networks:

Private range	CIDR notation
`10.0.0.0` – `10.255.255.255`	`10.0.0.0/8`
`172.16.0.0` – `172.31.255.255`	`172.16.0.0/12`
`192.168.0.0` – `192.168.255.255`	`192.168.0.0/16`

These ranges are not routed directly across the public Internet. They can be reused in separate private networks, but the ranges must not overlap when you plan to connect those networks through VPC peering, Transit Gateway, VPN, or Direct Connect.

What does `0.0.0.0/0` mean?

0.0.0.0/0 is the broadest possible IPv4 CIDR block. It matches every IPv4 address from 0.0.0.0 through 255.255.255.255.

It does not mean that traffic is automatically allowed. The meaning depends on where the CIDR appears:

AWS location	Meaning of `0.0.0.0/0`
Route table	A route for all IPv4 destinations that do not have a more specific route
Security group	A rule applying to all IPv4 sources or destinations, subject to protocol and port
Network ACL	A rule applying to all IPv4 addresses, subject to rule number and allow/deny behaviour

For example, a route table entry of 0.0.0.0/0 targeting an Internet Gateway is commonly used for Internet-bound IPv4 traffic from a public subnet. A security-group rule allowing TCP port 80 from 0.0.0.0/0 allows HTTP attempts from any IPv4 address, assuming the rest of the network path is available.

The IPv6 equivalent is:

::/0

0.0.0.0/0 does not include IPv6 addresses. IPv4 and IPv6 CIDR blocks are configured separately.

Security-group examples

CIDR blocks are frequently used as security-group sources and destinations.

Public website

Protocol	Port	Source	Meaning
TCP	80	`0.0.0.0/0`	Allow HTTP from all IPv4 addresses
TCP	443	`0.0.0.0/0`	Allow HTTPS from all IPv4 addresses

This is appropriate only when the service is intentionally public. If the application also supports IPv6, create corresponding IPv6 rules using ::/0 or the required narrower IPv6 range.

Restricted administration

Protocol	Port	Source	Meaning
TCP	22	`203.0.113.10/32`	Documentation example for one administrator IP
TCP	3389	Approved corporate CIDR	Allow Windows administration from the company network

Never open SSH or RDP to 0.0.0.0/0 unless there is a specific, reviewed reason. A broad rule allows anyone on the Internet to attempt a connection. Prefer a narrow source range, a VPN, a bastion or controlled access service, and strong authentication.

Internal application access

An application security group might allow database traffic only from the application subnet or, preferably, from the application tier’s security group. A CIDR such as 10.0.2.0/24 describes the entire private subnet, while a /32 describes one exact private address.

CIDR and Network ACLs

Network ACLs are associated with subnets and can use CIDR blocks to allow or deny traffic. For example:

192.168.100.0/24

matches the complete 192.168.100.0 through 192.168.100.255 range. This could represent an office network in a study example.

Security groups and NACLs have different behaviour:

Characteristic	Security group	Network ACL
Scope	Resource or network interface	Subnet
Rule types	Allow only	Allow and deny
State	Stateful	Stateless
CIDR use	Source or destination in rules	Source or destination in numbered rules

CIDR defines which addresses a rule covers; it does not by itself define whether the rule is secure. The protocol, port, direction, route, and security control all matter.

A practical VPC example

Suppose an AWS environment uses:

VPC:             10.0.0.0/16
Public subnet:   10.0.1.0/24
Private subnet:  10.0.2.0/24

A simple policy might be:

The public subnet route table sends 0.0.0.0/0 to an Internet Gateway.
The web security group allows TCP 80 and 443 from 0.0.0.0/0.
The private application security group allows traffic from the web tier.
The database security group allows its database port only from the application tier.
SSH is restricted to a trusted administrator CIDR or managed access path.

The CIDR blocks describe both the network layout and the address scope of the security rules. The route tables determine where traffic can go; security groups and NACLs determine whether the matching traffic is permitted.

Cloud Practitioner exam notes

/32: One exact IPv4 address.
/24: 256 total IPv4 addresses.
/16: 65,536 total IPv4 addresses; a common VPC example.
/0: Every address in that IP version.
0.0.0.0/0: All IPv4 addresses.
::/0: All IPv6 addresses.
VPC CIDR: The overall address range for the virtual network.
Subnet CIDR: A smaller, non-overlapping range inside the VPC.
Security-group source: The CIDR range from which traffic is allowed.
NACL rule: A CIDR range combined with protocol, port, direction, and rule number.
AWS subnet reservation: Five IPv4 addresses per subnet are not available for resource assignment.

Easy memory trick

Think of CIDR as the size of an invitation:

/32: Invite one person.
/24: Invite one apartment building.
/16: Invite an entire neighbourhood.
/0: Invite the whole IPv4 Internet.

The larger the prefix number, the narrower the invitation.

Final takeaway

CIDR lets AWS describe an entire IP range with one compact value. Read the prefix length first, calculate the address count with 2^(32 - prefix), and then ask where the CIDR is being used: VPC, subnet, route table, security group, or NACL.

For the exam, remember the boundaries: /32 means one address, /24 means 256 addresses, /16 means 65,536 addresses, and 0.0.0.0/0 means every IPv4 address. In production, use the narrowest range that meets the requirement, especially for SSH, RDP, databases, and administrative access.

Sources

AWSCloud PractitionerNetworkingVPCCIDR

Written by

Tan Chin Siang

Backend and cloud software engineer writing about reliable systems, infrastructure automation, and engineering practice.