# Amazon VPC Subnet

> Subnets carry no charge themselves; what they determine is placement: which availability zone, which route table, and which resources share a network segment. ZopNight maps every subnet on its 6-hour discovery sweep and uses that placement data to attribute cost, group environments, and explain cross-AZ transfer charges.

Source: https://zop.dev/integrations/aws/subnet
Updated: 2026-08-19

---

A subnet is an address range within a VPC where instances and services are placed. Subnets carry no direct charge but define placement, availability-zone spread, and which resources share a network segment, which matters for attributing and reasoning about cost.

## Placement is the product

AWS meters nothing for a subnet: not its existence, its size, or its address consumption. What a subnet does is decide things that other meters care about: the availability zone a resource lands in (and therefore whether traffic to its peers crosses AZ boundaries at per-GB rates), the route table it inherits (and therefore whether egress flows through a billed NAT gateway or a free internet gateway), and the blast radius it shares with neighbours.

## The role subnets play in ZopNight

Subnets are discovered automatically on the 6-hour cycle and used as placement context, not cost items. That context does real work: cost attribution can group resources by subnet into environments, cross-AZ data transfer charges become explainable when the subnet map shows which chatty services live in different zones, and a NAT gateway's spend can be traced to the private subnets routing through it. Nothing about a subnet is schedulable because nothing about it runs.

## Network layouts that leak money one layer up

Subnet design errors bill through other resources. A private subnet in AZ-b routing through a NAT gateway in AZ-a pays cross-AZ transfer on every egress byte, silently. Services split across zones without a reason pay per-GB inter-AZ rates for their own internal chatter. And an abandoned subnet full of stopped-but-not-terminated instances marks an environment that was paused rather than cleaned up. The subnet is the free tombstone over billed EBS volumes.

## Reading the subnet map

The VPC console's Subnets view shows each subnet's VPC, availability zone, CIDR, and available address count. Route table association is the detail worth checking per subnet: it answers whether the subnet is effectively public or private, and which NAT path its workloads pay for. An empty subnet costs nothing and deletes cleanly once nothing references it.