Subnet
A subdivision of a network's address range, used as the unit of routing and, in cloud, of availability-zone placement.
A subnet is defined by a CIDR block — 10.0.1.0/24 gives 256 addresses, of which cloud providers
reserve a handful. Its route table decides where traffic leaves for, which is what makes a subnet
"public" (a route to an internet gateway) or "private" (no such route).
The two things people get wrong: sizing, because the range cannot be resized after creation and
a /28 that seemed generous runs out when an autoscaler or a Kubernetes CNI assigns an address per
pod; and zone binding, since a subnet exists in exactly one availability zone, so a
multi-AZ deployment needs a matching subnet in each.
Segmentation by tier — public / application / data — is the cheapest large reduction in blast radius available, because it means a compromised web instance cannot reach the database except through rules you wrote deliberately.