🖼️ See the drawing + lab 🏠 Course home 🌿 Branch on GitHub ✏️ View source

🖼️ आकृती आणि labThe drawing + lab पूर्ण पानावर उघडा ↗Open full page ↗

🧱 धडा 03 — Subnets आणि AZs: campus चे wings, प्रत्येक एका इमारतीत

📍 तुम्ही इथे आहात: 12 पैकी धडा 03 · मागे: lesson-02-cidr-ips · पुढे: lesson-04-route-tables

📦 या ब्रँचमध्ये काय आहे

धडे 01–02, आणि wings: plan_subnets() हे 10.20.0.0/16 चे नऊ /20 subnets कापते — तीन tiers (public, app, data) × तीन AZs — आणि vpc/network.py मधील reserved_addresses() / usable() दाखवतात की AWS प्रत्येक subnet मध्ये 5 पत्ते स्वतःकडे ठेवतो.

🧒 5 वर्षांच्या मुलाला समजावल्यासारखे

Campus एकच उघडा हॉल असण्याइतका लहान नाही. म्हणून तुम्ही wings 🧱 बांधता: मुख्य दरवाजाजवळ एक public wing, जिथे शिक्षिका काम करतात तो एक app wing, आणि जिथे परीक्षेचे पेपर कुलुपात ठेवलेले असतात तो एक data wing.

Campus च्या जमिनीवर एकमेकांपासून दूर अशा तीन इमारती 🏢🏢🏢 आहेत. वादळामुळे एक इमारत बंद झाली, तरी उरलेल्या दोन काम करत राहतात. म्हणून तुम्ही प्रत्येक wing तीन वेळा बांधता, प्रत्येक इमारतीत एकदा. एखादा wing कधीच दोन इमारतींमध्ये पसरत नाही.

प्रत्येक wing मध्ये रखवालदार 5 खोल्यांचे नंबर स्वतःसाठी ठेवतो: wing ची स्वतःची नावाची पाटी, corridor ची पाटी, phone book, एक जादा, आणि शेवटचा नंबर. ते 5 नंबर तुम्ही कधीच एखाद्या desk ला देऊ शकत नाही.

🗺️ आकृती

flowchart TB
    vpc["🏫 VPC 10.20.0.0/16"]
    subgraph az1["🏢 ap-south-1a"]
        p1["public 10.20.0.0/20"]
        a1["app 10.20.48.0/20"]
        d1["data 10.20.96.0/20"]
    end
    subgraph az2["🏢 ap-south-1b"]
        p2["public 10.20.16.0/20"]
        a2["app 10.20.64.0/20"]
        d2["data 10.20.112.0/20"]
    end
    subgraph az3["🏢 ap-south-1c"]
        p3["public 10.20.32.0/20"]
        a3["app 10.20.80.0/20"]
        d3["data 10.20.128.0/20"]
    end
    vpc --> az1
    vpc --> az2
    vpc --> az3
    r["🪪 every subnet: 5 reserved<br/>.0 · .1 router · .2 DNS · .3 future · last"]
    d1 -.-> r

🗺️ काढलेली आकृती + एक lab: https://school-edh.pages.dev/vpc/lesson-diagrams.html#l03

❓ काय

Subnet — VPC च्या range मधून कापलेला CIDR block, जो एका Availability Zone मध्ये ठेवलेला असतो. Subnet चे आकारही /16 आणि /28 च्या दरम्यान असतात. एका VPC मधील subnets एकमेकांशी overlap होऊ शकत नाहीत.
Availability Zone (AZ) — Region मधील एक किंवा अधिक data centres, स्वतंत्र वीज आणि network असलेले, इतरांपासून काही किलोमीटर दूर. बहुतेक Regions मध्ये तीन किंवा अधिक असतात.
Tiers — नेहमीची रचना: public (load balancers, NAT gateways), app (servers, public IPs नाहीत), data (databases, internet route अजिबात नाही). प्रत्येक AZ मध्ये प्रत्येक tier साठी एक subnet.
5 राखीव पत्ते — प्रत्येक subnet मध्ये AWS हे ठेवतो: network address (.0), VPC router साठी +1, DNS साठी +2 (resolver स्वतः VPC base + 2 वर असतो — धडा 08), भविष्यातील वापरासाठी +3, आणि शेवटचा पत्ता (broadcast — AWS broadcast ला support करत नाही, तरीही तो राखून ठेवतो). म्हणून /24 मध्ये 251 वापरता येणारे पत्ते मिळतात, आणि /28 मध्ये 11.
AZ names विरुद्ध AZ IDs — तुमच्या account मधला ap-south-1a हा दुसऱ्या account मधल्या ap-south-1a पेक्षा वेगळा प्रत्यक्ष AZ असू शकतो. AZ ID (जसे aps1-az1) सगळीकडे सारखाच असतो; दोन accounts जुळवायचे असतील तेव्हा तोच वापरा.

🤔 का

कारण एक AZ बंद पडू शकतो, आणि subnet दुसऱ्या AZ मध्ये हलवता येत नाही. तीन इमारतींमध्ये wings असले की एक इमारत गेल्यावर तुमची फक्त एक तृतीयांश क्षमता जाते, सगळी नाही. आणि tiers मुळे प्रत्येक wing ला वेगळ्या पाट्या (धडा 04) आणि वेगळी दारे (धडा 06) मिळू शकतात.

🔧 कसे (या repo मध्ये)

vpc/network.py मधील plan_subnets(vpc_cidr, new_prefix, tiers, azs) ip_network(vpc_cidr).subnets(new_prefix=...) मधून जातो आणि क्रमाने प्रत्येक (tier, AZ) ला एक block देतो. reserved_addresses() block मधील 0, 1, 2, 3 आणि −1 या जागा परत करतो; usable() म्हणजे block चा आकार वजा RESERVED = 5. vpc/demo.py मधील subnets() नऊ wings चा आराखडा छापतो.

🧪 करून पाहा

python3 vpc/demo.py subnets
python3 - <<'EOF'
import sys; sys.path.insert(0, "vpc"); from network import plan_subnets, usable, reserved_addresses
for tier, az, c in plan_subnets("10.20.0.0/16", 22, ["public", "app"], ["ap-south-1a", "ap-south-1b"]):
    print(tier, az, c, usable(c))
print(reserved_addresses("10.20.96.0/28"), usable("10.20.96.0/28"))
EOF

✅ तपासा — तुम्हाला काय दिसायला हवे

subnets नऊ ओळी छापतो, public ap-south-1a 10.20.0.0/20 4,091 usable पासून data ap-south-1c 10.20.128.0/20 4,091 usable पर्यंत, आणि मग:

── in EVERY subnet AWS keeps 5 addresses — 10.20.0.0/24: 10.20.0.0, 10.20.0.1, 10.20.0.2, 10.20.0.3, 10.20.0.255
   so a /24 gives 251 usable addresses, not 256 · a /28 (the smallest) gives 11

तुमचा snippet चार /22 wings छापतो — 10.20.0.0/22, 10.20.4.0/22, 10.20.8.0/22, 10.20.12.0/22, प्रत्येकात 1019 वापरता येणारे — आणि मग ['10.20.96.0', '10.20.96.1', '10.20.96.2', '10.20.96.3', '10.20.96.15'] 11.

🏁 तुम्ही आत्ताच काय सिद्ध केले

तुम्ही campus चे प्रत्येक इमारतीसाठी wings कापू शकता, आणि 4,096 पत्त्यांचे 4,091 — आणि 16 चे 11 — का होतात हे तुम्हाला माहीत आहे.

⚠️ नेहमीच्या चुका

सगळे subnets एकाच AZ मध्ये — एक इमारत बंद झाली की सगळे थांबते
वाढणाऱ्या गोष्टींसाठी (Auto Scaling, EKS, VPC मधील Lambda) /28 subnets — फक्त 11 पत्ते
आकार ठरवताना 5 राखीव पत्ते विसरणे ("/24 मध्ये 256 servers बसतात")
accounts मध्ये AZs AZ ID ऐवजी नावाने जुळवणे
आजच्या subnets साठी पूर्ण VPC range वापरणे — उद्याच्या tier साठी काहीच उरत नाही

🏭 प्रत्यक्ष वापरात

Teams subnets code मधून कापतात, म्हणजे प्रत्येक environment मध्ये आराखडा सारखाच राहतो.

खऱ्या account वर (AWS CLI आणि credentials लागतात; IDs उदाहरणादाखल आहेत):

aws ec2 describe-availability-zones --query 'AvailabilityZones[].[ZoneName,ZoneId]' --output table
aws ec2 create-subnet --vpc-id vpc-0123456789abcdef0 --cidr-block 10.20.48.0/20 --availability-zone ap-south-1a
aws ec2 describe-subnets --filters Name=vpc-id,Values=vpc-0123456789abcdef0 \
    --query 'Subnets[].[CidrBlock,AvailabilityZone,AvailableIpAddressCount]' --output table

Terraform मध्ये cidrsubnet("10.20.0.0/16", 4, n) lab सारखेच /20 blocks देतो: n = 0 → 10.20.0.0/20, n = 3 → 10.20.48.0/20, n = 8 → 10.20.128.0/20.

locals { azs = ["ap-south-1a", "ap-south-1b", "ap-south-1c"] }

resource "aws_subnet" "app" {
  count             = 3
  vpc_id            = aws_vpc.school.id
  availability_zone = local.azs[count.index]
  cidr_block        = cidrsubnet(aws_vpc.school.cidr_block, 4, 3 + count.index)
  tags              = { Name = "app-${count.index}" }
}

⏭️ पुढे

नऊ wings, आणि अजून एकही पाटी नाही. Packet ला कुठे जायचे ते कसे कळते? Route tables — corridor च्या पाट्या.

git checkout lesson-04-route-tables

🧱 Lesson 03 — Subnets & AZs: wings of the campus, each in one building

📍 You are here: Lesson 03 of 12 · Previous: lesson-02-cidr-ips · Next: lesson-04-route-tables

📦 What's in this branch

Lessons 01–02, plus the wings: plan_subnets() carves 10.20.0.0/16 into nine /20 subnets — three tiers (public, app, data) × three AZs — and reserved_addresses() / usable() in vpc/network.py show the 5 addresses AWS keeps in every subnet.

🧒 Explain like I'm 5

The campus is too big to be one open hall. So you build wings 🧱: a public wing near the front gate, an app wing where the teachers work, and a data wing where the exam papers are locked away.

The campus stands on land with three buildings 🏢🏢🏢 far apart from each other. If a storm closes one building, the other two keep working. So you build each wing three times, once in every building. A wing never stretches across two buildings.

In every wing, the caretaker keeps 5 room numbers for himself: the wing's own name plate, the corridor sign, the phone book, one spare, and the last number. You can never give those 5 to a desk.

🗺️ Diagram

flowchart TB
    vpc["🏫 VPC 10.20.0.0/16"]
    subgraph az1["🏢 ap-south-1a"]
        p1["public 10.20.0.0/20"]
        a1["app 10.20.48.0/20"]
        d1["data 10.20.96.0/20"]
    end
    subgraph az2["🏢 ap-south-1b"]
        p2["public 10.20.16.0/20"]
        a2["app 10.20.64.0/20"]
        d2["data 10.20.112.0/20"]
    end
    subgraph az3["🏢 ap-south-1c"]
        p3["public 10.20.32.0/20"]
        a3["app 10.20.80.0/20"]
        d3["data 10.20.128.0/20"]
    end
    vpc --> az1
    vpc --> az2
    vpc --> az3
    r["🪪 every subnet: 5 reserved<br/>.0 · .1 router · .2 DNS · .3 future · last"]
    d1 -.-> r

🗺️ Drawn version + a lab: https://school-edh.pages.dev/vpc/lesson-diagrams.html#l03

❓ What

Subnet — a CIDR block carved from the VPC's range, placed in one Availability Zone. Subnet sizes are also between /16 and /28. Subnets in one VPC may not overlap.
Availability Zone (AZ) — one or more data centres in a Region, with separate power and network, a few kilometres from the others. Most Regions have three or more.
Tiers — a common pattern: public (load balancers, NAT gateways), app (servers, no public IPs), data (databases, no internet route at all). One subnet per tier per AZ.
The 5 reserved addresses — in every subnet, AWS keeps: the network address (.0), +1 for the VPC router, +2 for DNS (the resolver itself is at the VPC base + 2 — lesson 08), +3 for future use, and the last address (broadcast — AWS does not support broadcast, but keeps it anyway). So a /24 gives 251 usable addresses, and a /28 gives 11.
AZ names vs AZ IDs — ap-south-1a in your account may be a different physical AZ than ap-south-1a in another account. The AZ ID (like aps1-az1) is the same everywhere; use it when two accounts must line up.

🤔 Why

Because one AZ can fail, and a subnet cannot move to another AZ. Wings in three buildings mean a lost building costs you a third of your capacity, not all of it. And because the tiers let each wing get different signs (lesson 04) and different doors (lesson 06).

🔧 How (in this repo)

plan_subnets(vpc_cidr, new_prefix, tiers, azs) in vpc/network.py walks ip_network(vpc_cidr).subnets(new_prefix=...) and hands out one block per (tier, AZ) in order. reserved_addresses() returns positions 0, 1, 2, 3 and −1 of a block; usable() is the block size minus RESERVED = 5. subnets() in vpc/demo.py prints the nine-wing plan.

🧪 Try it

python3 vpc/demo.py subnets
python3 - <<'EOF'
import sys; sys.path.insert(0, "vpc"); from network import plan_subnets, usable, reserved_addresses
for tier, az, c in plan_subnets("10.20.0.0/16", 22, ["public", "app"], ["ap-south-1a", "ap-south-1b"]):
    print(tier, az, c, usable(c))
print(reserved_addresses("10.20.96.0/28"), usable("10.20.96.0/28"))
EOF

✅ Verify — what you should see

subnets prints nine lines, from public ap-south-1a 10.20.0.0/20 4,091 usable to data ap-south-1c 10.20.128.0/20 4,091 usable, then:

── in EVERY subnet AWS keeps 5 addresses — 10.20.0.0/24: 10.20.0.0, 10.20.0.1, 10.20.0.2, 10.20.0.3, 10.20.0.255
   so a /24 gives 251 usable addresses, not 256 · a /28 (the smallest) gives 11

Your snippet prints four /22 wings — 10.20.0.0/22, 10.20.4.0/22, 10.20.8.0/22, 10.20.12.0/22, each with 1019 usable — then ['10.20.96.0', '10.20.96.1', '10.20.96.2', '10.20.96.3', '10.20.96.15'] 11.

🏁 What you just proved

You can carve a campus into wings per building, and you know why 4,096 addresses become 4,091 — and 16 become 11.

⚠️ Common mistakes

all subnets in one AZ — one building closes, everything stops
/28 subnets for things that grow (Auto Scaling, EKS, Lambda in a VPC) — only 11 addresses
forgetting the 5 reserved addresses when sizing ("a /24 holds 256 servers")
matching AZs across accounts by name instead of by AZ ID
using the whole VPC range for today's subnets — nothing left for tomorrow's tier

🏭 In production

Teams carve subnets from code, so the plan is the same in every environment.

On a real account (needs the AWS CLI and credentials; IDs are examples):

aws ec2 describe-availability-zones --query 'AvailabilityZones[].[ZoneName,ZoneId]' --output table
aws ec2 create-subnet --vpc-id vpc-0123456789abcdef0 --cidr-block 10.20.48.0/20 --availability-zone ap-south-1a
aws ec2 describe-subnets --filters Name=vpc-id,Values=vpc-0123456789abcdef0 \
    --query 'Subnets[].[CidrBlock,AvailabilityZone,AvailableIpAddressCount]' --output table

In Terraform, cidrsubnet("10.20.0.0/16", 4, n) gives the same /20 blocks as the lab: n = 0 → 10.20.0.0/20, n = 3 → 10.20.48.0/20, n = 8 → 10.20.128.0/20.

locals { azs = ["ap-south-1a", "ap-south-1b", "ap-south-1c"] }

resource "aws_subnet" "app" {
  count             = 3
  vpc_id            = aws_vpc.school.id
  availability_zone = local.azs[count.index]
  cidr_block        = cidrsubnet(aws_vpc.school.cidr_block, 4, 3 + count.index)
  tags              = { Name = "app-${count.index}" }
}

⏭️ Next

Nine wings, and no signs yet. How does a packet know where to walk? Route tables — the corridor signs.

git checkout lesson-04-route-tables

← Previouscidr ips Next →route tables

This page is the lesson's README from the lesson-03-subnets-azs branch, shown here so the whole School stays on one site. Code files open on GitHub at the same branch.