由于子网无效，无法在 AWS 中创建 VPC

Question

I'm using cloud formation to create a VPC. And it fails when it gets to creating the subnets. I checked and I believe the subnets to be valid. Though my networking knowledge is somewhat lacking.

This is the error I get:

00:46:49 UTC-0400   CREATE_FAILED   AWS::EC2::Subnet    SubnetA The CIDR '172.16.64.0/16' is invalid.

00:46:49 UTC-0400 CREATE_IN_PROGRESS AWS::EC2::RouteTable RouteTable Resource creation Initiated 00:46:49 UTC-0400 CREATE_FAILED AWS::EC2::Subnet SubnetB The CIDR '197.16.128.0/16' is invalid.

And this is the template I'm trying to use:

---
AWSTemplateFormatVersion: 2010-09-09
Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 172.16.0.0/18
      EnableDnsSupport: true
      EnableDnsHostnames: true
      InstanceTenancy: default
      Tags:
      - Key: Name
        Value: JF-Staging-VPC
  InternetGateway:
     Type: AWS::EC2::InternetGateway
  VPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway
  SubnetA:
     Type: AWS::EC2::Subnet
     Properties:
       AvailabilityZone: us-east-1a
       VpcId: !Ref VPC
       CidrBlock: 172.16.64.0/16
       MapPublicIpOnLaunch: False
  SubnetB:
      Type: AWS::EC2::Subnet
      Properties:
        AvailabilityZone: us-east-1b
        VpcId: !Ref VPC
        CidrBlock: 197.16.128.0/16
        MapPublicIpOnLaunch: False
  RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
  InternetRoute:
    Type: AWS::EC2::Route
    DependsOn: InternetGateway
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
      RouteTableId: !Ref RouteTable
  SubnetARouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref RouteTable
      SubnetId: !Ref SubnetA
  SubnetBRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref RouteTable
      SubnetId: !Ref SubnetB
  SecurityGroupSSH:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: "SSH Group"
      GroupDescription: "SSH traffic in, all traffic out."
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '22'
          ToPort: '22'
          CidrIp: 0.0.0.0/0
      SecurityGroupEgress:
        - IpProtocol: -1
          CidrIp: 0.0.0.0/0
  SecurityGroupWeb:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: "Web Group"
      GroupDescription: "Web traffic in, all traffic out."
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '80'
          ToPort: '80'
          CidrIp: 0.0.0.0/0
      SecurityGroupEgress:
        - IpProtocol: -1
          CidrIp: 0.0.0.0/0
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '443'
          ToPort: '443'
          CidrIp: 0.0.0.0/0
      SecurityGroupEgress:
        - IpProtocol: -1
          CidrIp: 0.0.0.0/0
Metadata:
  VPC:
    Description: "Creating the JF Staging VPC"
  InternetGateway:
    Description: "Creating an Internet Gateway"

Can someone let me know where I'm going wrong and how to correct this?

Answer 1

As per the error message, your IP address (CIDR) ranges are invalid.

It sets the following CIDR ranges:

• VPC: 172.16.0.0/18
• SubnetA: 172.16.64.0/16
• SubnetB: 197.16.128.0/16

Neither of these subnet ranges is part of the VPC range. All subnet ranges must fall within the range specified by the VPC. In fact, both of your subnets are larger (/16) than the VPC (/18).

Here, for example, are ranges that work fine:

• VPC: 172.16.0.0/16
• SubnetA: 172.16.64.0/24
• SubnetB: 172.16.128.0/24

If you do not understand CIDR ranges, see: Understanding IP Addresses, Subnets, and CIDR Notation for Networking

Answer 2

The issue is with 197.16.128.0/16 which is a public IP address which cannot be assigned to a VPC or a subnet.

I think that you really meant to use the address:

172.16.128.0/16

[EDIT]

Change your VPC to 172.16.0.0/16 Then change each subnet to use a portion of the /16 eg /24 Examples:

172.16.0.0/24

172.16.1.0/24

172.16.2.0/24

etc.

The issue with your current implementation is that your VPC is /18 which is smaller than the subnets that you are trying to create /16. You want the reverse, /16 for the VPC and /24 or anything smaller than /16 for the subnets.