failure to create VPC in AWS due to invalid subnets - amazon-web-services

Question

I'm using cloud formation to create a VPC. And it fails when it gets to creating the subnets. I checked and I believe the subnets to be valid. Though my networking knowledge is somewhat lacking.
This is the error I get:
00:46:49 UTC-0400 CREATE_FAILED AWS::EC2::Subnet SubnetA The CIDR '172.16.64.0/16' is invalid.
00:46:49 UTC-0400 CREATE_IN_PROGRESS AWS::EC2::RouteTable RouteTable Resource creation Initiated
00:46:49 UTC-0400 CREATE_FAILED AWS::EC2::Subnet SubnetB The CIDR '197.16.128.0/16' is invalid.
And this is the template I'm trying to use:
---
AWSTemplateFormatVersion: 2010-09-09
Resources:
VPC:
Type: AWS::EC2::VPC
Properties:
CidrBlock: 172.16.0.0/18
EnableDnsSupport: true
EnableDnsHostnames: true
InstanceTenancy: default
Tags:
- Key: Name
Value: JF-Staging-VPC
InternetGateway:
Type: AWS::EC2::InternetGateway
VPCGatewayAttachment:
Type: AWS::EC2::VPCGatewayAttachment
Properties:
VpcId: !Ref VPC
InternetGatewayId: !Ref InternetGateway
SubnetA:
Type: AWS::EC2::Subnet
Properties:
AvailabilityZone: us-east-1a
VpcId: !Ref VPC
CidrBlock: 172.16.64.0/16
MapPublicIpOnLaunch: False
SubnetB:
Type: AWS::EC2::Subnet
Properties:
AvailabilityZone: us-east-1b
VpcId: !Ref VPC
CidrBlock: 197.16.128.0/16
MapPublicIpOnLaunch: False
RouteTable:
Type: AWS::EC2::RouteTable
Properties:
VpcId: !Ref VPC
InternetRoute:
Type: AWS::EC2::Route
DependsOn: InternetGateway
Properties:
DestinationCidrBlock: 0.0.0.0/0
GatewayId: !Ref InternetGateway
RouteTableId: !Ref RouteTable
SubnetARouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
RouteTableId: !Ref RouteTable
SubnetId: !Ref SubnetA
SubnetBRouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
RouteTableId: !Ref RouteTable
SubnetId: !Ref SubnetB
SecurityGroupSSH:
Type: AWS::EC2::SecurityGroup
Properties:
GroupName: "SSH Group"
GroupDescription: "SSH traffic in, all traffic out."
VpcId: !Ref VPC
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: '22'
ToPort: '22'
CidrIp: 0.0.0.0/0
SecurityGroupEgress:
- IpProtocol: -1
CidrIp: 0.0.0.0/0
SecurityGroupWeb:
Type: AWS::EC2::SecurityGroup
Properties:
GroupName: "Web Group"
GroupDescription: "Web traffic in, all traffic out."
VpcId: !Ref VPC
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: '80'
ToPort: '80'
CidrIp: 0.0.0.0/0
SecurityGroupEgress:
- IpProtocol: -1
CidrIp: 0.0.0.0/0
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: '443'
ToPort: '443'
CidrIp: 0.0.0.0/0
SecurityGroupEgress:
- IpProtocol: -1
CidrIp: 0.0.0.0/0
Metadata:
VPC:
Description: "Creating the JF Staging VPC"
InternetGateway:
Description: "Creating an Internet Gateway"
Can someone let me know where I'm going wrong and how to correct this?

Answer 1

As per the error message, your IP address (CIDR) ranges are invalid.
It sets the following CIDR ranges:
VPC: 172.16.0.0/18
SubnetA: 172.16.64.0/16
SubnetB: 197.16.128.0/16
Neither of these subnet ranges is part of the VPC range. All subnet ranges must fall within the range specified by the VPC. In fact, both of your subnets are larger (/16) than the VPC (/18).
Here, for example, are ranges that work fine:
VPC: 172.16.0.0/16
SubnetA: 172.16.64.0/24
SubnetB: 172.16.128.0/24
If you do not understand CIDR ranges, see: Understanding IP Addresses, Subnets, and CIDR Notation for Networking

Answer 2

The issue is with 197.16.128.0/16 which is a public IP address which cannot be assigned to a VPC or a subnet.
I think that you really meant to use the address:
172.16.128.0/16
[EDIT]
Change your VPC to 172.16.0.0/16
Then change each subnet to use a portion of the /16 e.g. /24
Examples:
172.16.0.0/24
172.16.1.0/24
172.16.2.0/24
etc.
The issue with your current implementation is that your VPC is /18 which is smaller than the subnets that you are trying to create /16. You want the reverse, /16 for the VPC and /24 or anything smaller than /16 for the subnets.