---
type: resource-type
title: Subnet
description: aws resource type AWS::EC2::Subnet
name: Subnet
lexicon: aws
resource_type: AWS::EC2::Subnet
---
`AWS::EC2::Subnet`, a resource type of the aws lexicon.

## Properties

- `VpcId` (`string`, required): The ID of the VPC the subnet is in. If you update this property, you must also update the ``CidrBlock`` property.
- `AssignIpv6AddressOnCreation` (`boolean`, optional): Indicates whether a network interface created in this subnet receives an IPv6 address. The default value is ``false``. If you specify ``AssignIpv6AddressOnCreation``, you must also specify an IPv6 CIDR block.
- `AvailabilityZone` (`string`, optional): The Availability Zone of the subnet. If you update this property, you must also update the ``CidrBlock`` property.
- `AvailabilityZoneId` (`string`, optional): The AZ ID of the subnet.
- `BlockPublicAccessStates` (`Record<string, unknown>`, optional)
- `CidrBlock` (`string`, optional): The IPv4 CIDR block assigned to the subnet. If you update this property, we create a new subnet, and then delete the existing one.
- `EnableDns64` (`boolean`, optional): Indicates whether DNS queries made to the Amazon-provided DNS Resolver in this subnet should return synthetic IPv6 addresses for IPv4-only destinations. You must first configure a NAT gateway in a public subnet (separate from the subnet containing the IPv6-only workloads). For example, the subnet containing the NAT gateway should have a ``0.0.0.0/0`` route pointing to the internet gateway. For more information, see [Configure DNS64 and NAT64](https://docs.aws.amazon.com/vpc/latest/userguide/nat-gateway-nat64-dns64.html#nat-gateway-nat64-dns64-walkthrough) in the *User Guide*.
- `EnableLniAtDeviceIndex` (`number`, optional): Indicates the device position for local network interfaces in this subnet. For example, ``1`` indicates local network interfaces in this subnet are the secondary network interface (eth1).
- `Ipv4IpamPoolId` (`string`, optional): An IPv4 IPAM pool ID for the subnet.
- `Ipv4NetmaskLength` (`number`, optional): An IPv4 netmask length for the subnet.
- `Ipv6CidrBlock` (`string`, optional): The IPv6 CIDR block. If you specify ``AssignIpv6AddressOnCreation``, you must also specify an IPv6 CIDR block.
- `Ipv6CidrBlocks` (`string[]`, optional)
- `Ipv6IpamPoolId` (`string`, optional): An IPv6 IPAM pool ID for the subnet.
- `Ipv6Native` (`boolean`, optional): Indicates whether this is an IPv6 only subnet. For more information, see [Subnet basics](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html#subnet-basics) in the *User Guide*.
- `Ipv6NetmaskLength` (`number`, optional): An IPv6 netmask length for the subnet.
- `MapPublicIpOnLaunch` (`boolean`, optional): Indicates whether instances launched in this subnet receive a public IPv4 address. The default value is ``false``. AWS charges for all public IPv4 addresses, including public IPv4 addresses associated with running instances and Elastic IP addresses. For more information, see the *Public IPv4 Address* tab on the [VPC pricing page](https://docs.aws.amazon.com/vpc/pricing/).
- `NetworkAclAssociationId` (`string`, optional)
- `OutpostArn` (`string`, optional): The Amazon Resource Name (ARN) of the Outpost.
- `PrivateDnsNameOptionsOnLaunch` (`Record<string, unknown>`, optional): The hostname type for EC2 instances launched into this subnet and how DNS A and AAAA record queries to the instances should be handled. For more information, see [Amazon EC2 instance hostname types](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-naming.html) in the *User Guide*. Available options: + EnableResourceNameDnsAAAARecord (true | false) + EnableResourceNameDnsARecord (true | false) + HostnameType (ip-name | resource-name)
- `SubnetId` (`string`, optional)
- `Tags` (`Subnet_Tag[]`, optional): Any tags assigned to the subnet.

## Attributes

- `BlockPublicAccessStates`
- `Ipv6CidrBlocks`
- `NetworkAclAssociationId`
- `SubnetId`

## Governed by

- [WAW061](/rules/WAW061.md): Subnet CidrBlock falls outside its VPC's CidrBlock — fails at deploy time