concept

Subnet

A subdivision of a network's address range, used as the unit of routing and, in cloud, of availability-zone placement.

networkcidrsegmentation

A subnet is defined by a CIDR block — 10.0.1.0/24 gives 256 addresses, of which cloud providers reserve a handful. Its route table decides where traffic leaves for, which is what makes a subnet "public" (a route to an internet gateway) or "private" (no such route).

The two things people get wrong: sizing, because the range cannot be resized after creation and a /28 that seemed generous runs out when an autoscaler or a Kubernetes CNI assigns an address per pod; and zone binding, since a subnet exists in exactly one availability zone, so a multi-AZ deployment needs a matching subnet in each.

Segmentation by tier — public / application / data — is the cheapest large reduction in blast radius available, because it means a compromised web instance cannot reach the database except through rules you wrote deliberately.