If you've provisioned a VPC from a Terraform module without fully internalising what each piece is doing, that's fine — right up until something breaks. An instance that should be reachable isn't. A private instance can't pull a package update. And you're left checking five different resources with no clear mental model of how they connect.
This post builds that mental model from the ground up. Not just definitions — the why behind each piece, so troubleshooting becomes deduction instead of guesswork.
CIDR math you actually need
A CIDR block is IP address / prefix length. The prefix length fixes the network portion; the remaining bits are your host space.
Formula: 2^(32 - prefix) = total addresses. AWS reserves 5 per subnet (network address, VPC router, DNS, reserved, broadcast).
