Most subnet articles start from a blank piece of paper and end with a clean diagram. That is not the situation most teams are actually in. The situation is a Confluence page from 2019, a router config someone exported last quarter, and a network engineer who swears "the 10.40.0.0/16 is in use somewhere" but cannot remember where. The migration deadline is in three weeks. Your job is to prove, on paper, that every existing subnet still fits its purpose, that nothing overlaps, and that the new VPC ranges will not collide with anything that survives the cutover.
This is the audit mindset. It is mostly arithmetic, a little detective work, and a lot of writing things down so the next person does not have to redo it.
Treat the Audit Like a Code Review
A subnet plan is a piece of infrastructure code. It deserves the same hygiene as a Terraform module: a source of truth, a diff against reality, and a sign-off. Before touching anything, gather the inputs into one place:
An export of every router, switch, and firewall interface description. The description string on GigabitEthernet0/0/0 is often the only thing that says "links to warehouse printer VLAN."
