I'm writing a few templates to create a stack on demand. Because of the concurrent VPC limitations (5 to start), I'm attempting to create all the feature-based dev environments on a single VPC and mostly divide the stacks by subnets. The idea is that every stack will have 2 private and 2 public subnets. I know I can get specific CIDRs with something like this (YAML):

!Select [ 0, !Cidr [ !GetAtt MyVpc.CidrBlock, 1, 8 ]]

But I need to make sure I'm getting CIDRs that are not being used by some of the other stack. Programmatically, I would get all CIDR blocks from the VPC and then filter all the ones that are used by other subnets, to get a final array (or simply return x items from the array).

Is getting a block of free CIDRs or a single free one something I can do with the intrinsic functions?

1 Answer 1


Don't worry about putting each stack in its own set of subnets, that's an overkill.

Simply make the resources' Security Groups refer to other SGs in your stack templates and not to subnet CIDRs.

What that means is for example the RDS SG sg-123456 will permit traffic from App SG sg-9876543 and not from the App subnet you'll be fine from the network isolation perspective.

We usually have the VPC infrastructure shared for dev, test and feature stacks. That's perfectly fine. Moreover we also use CloudFormation Exports to simplify the templates.

Hope that helps :)

  • It is an interesting approach. I'll see if this is a good alternative for our scenario.
    – Manatax
    Commented Jul 26, 2019 at 7:11
  • Loved the blog post too. I'll be adding that as well.
    – Manatax
    Commented Jul 27, 2019 at 2:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.