🚨 AWS Error Guide: 'InsufficientFreeAddressesInSubnet' — Free or Expand Subnet IP Space

Overview

Every ENI (elastic network interface) AWS attaches — for EC2 instances, EKS pods, Fargate tasks, RDS instances, NAT gateways, VPC endpoints, and Lambdas in a VPC — consumes a private IPv4 address from its subnet’s CIDR. AWS also reserves 5 addresses per subnet. When a launch needs an address and none are free, the operation fails with InsufficientFreeAddressesInSubnet. The subnet’s usable host space is exhausted, not the account or the VPC as a whole.

You will see it from the CLI, an ASG, or an SDK:

An error occurred (InsufficientFreeAddressesInSubnet) when calling the RunInstances operation: There are not enough free addresses in subnet 'subnet-REDACTED' to satisfy the requested number of instances.

EKS/CNI logs phrase it around ENI allocation:

failed to assign an IP address to container ... InsufficientFreeAddressesInSubnet: The specified subnet does not have enough free addresses to satisfy the request.

It occurs on undersized subnets (a /27 gives only 27 usable IPs), on IP-hungry EKS clusters where the VPC CNI pre-allocates addresses, and where leaked/orphaned ENIs quietly hold addresses.

Symptoms

• RunInstances, an Auto Scaling group, or a Fargate task fails with InsufficientFreeAddressesInSubnet.
• EKS pods stick in ContainerCreating and CNI logs show IP-allocation failures.
• RDS/ElastiCache creation or a Multi-AZ failover fails to place an ENI.
• New VPC endpoints or a NAT gateway cannot be created in a crowded subnet.

aws ec2 describe-subnets --subnet-ids subnet-REDACTED \
  --query 'Subnets[0].[CidrBlock,AvailableIpAddressCount]' --output text

10.0.4.0/27	0

Zero available addresses in a /27 — the subnet is full.

Common Root Causes

1. The subnet CIDR is simply too small

A /27 or /28 leaves only a couple dozen usable IPs after AWS’s 5 reserved addresses — fine for a bastion, far too small for a workload subnet.

aws ec2 describe-subnets --subnet-ids subnet-REDACTED \
  --query 'Subnets[0].[CidrBlock,AvailableIpAddressCount]' --output text

10.0.4.0/28	0

A /28 has 11 usable addresses total — trivially exhausted.

2. EKS VPC CNI pre-allocating addresses

The Amazon VPC CNI assigns a warm pool of secondary IPs per node, so a handful of nodes can reserve hundreds of subnet addresses even with few pods running.

aws ec2 describe-network-interfaces \
  --filters Name=subnet-id,Values=subnet-REDACTED Name=interface-type,Values=interface \
  --query 'length(NetworkInterfaces)' --output text

243

243 ENIs in one subnet — the CNI’s warm IP pool has consumed the space.

3. Leaked or orphaned ENIs

ENIs left behind by deleted Lambdas, failed launches, or removed load balancers stay available and keep holding an address.

aws ec2 describe-network-interfaces \
  --filters Name=subnet-id,Values=subnet-REDACTED Name=status,Values=available \
  --query 'NetworkInterfaces[].[NetworkInterfaceId,Description]' --output text

eni-REDACTED	AWS Lambda VPC ENI
eni-REDACTED	ELB app/old-alb

Detached ENIs from a deleted Lambda and an old ALB still occupy IPs.

4. All capacity concentrated in one AZ/subnet

An ASG or workload pinned to a single subnet exhausts it while other AZs’ subnets sit empty.

aws ec2 describe-subnets --filters Name=vpc-id,Values=vpc-REDACTED \
  --query 'Subnets[].[SubnetId,AvailabilityZone,AvailableIpAddressCount]' --output text

subnet-REDACTED	us-east-1a	0
subnet-REDACTED	us-east-1b	4091

AZ a is full while b has thousands free — the workload is not spread.

5. Large fixed allocations (NAT, endpoints, RDS Multi-AZ)

Many interface VPC endpoints, NAT gateways, or database ENIs in a small shared subnet crowd out compute.

aws ec2 describe-network-interfaces \
  --filters Name=subnet-id,Values=subnet-REDACTED \
  --query 'NetworkInterfaces[].InterfaceType' --output text | tr '\t' '\n' | sort | uniq -c

  18 vpc_endpoint
   3 nat_gateway
  40 interface

18 endpoint ENIs plus NAT gateways eat into a subnet meant for instances.

Diagnostic Workflow

Step 1: Confirm the subnet is actually out of addresses

aws ec2 describe-subnets --subnet-ids <subnet-id> \
  --query 'Subnets[0].[CidrBlock,AvailableIpAddressCount,AvailabilityZone]' --output text

AvailableIpAddressCount of 0 (or fewer than the launch needs) confirms it, and the CIDR tells you how much total space exists.

Step 2: See what is consuming the addresses

aws ec2 describe-network-interfaces \
  --filters Name=subnet-id,Values=<subnet-id> \
  --query 'NetworkInterfaces[].[Status,InterfaceType,Description]' --output text \
  | sort | uniq -c | sort -rn | head

This groups ENIs by status/type so you can tell leaked (available) from in-use, and CNI from endpoints.

Step 3: Find reclaimable orphaned ENIs

aws ec2 describe-network-interfaces \
  --filters Name=subnet-id,Values=<subnet-id> Name=status,Values=available \
  --query 'NetworkInterfaces[].NetworkInterfaceId' --output text

available ENIs are detached and can usually be deleted to reclaim IPs immediately.

Step 4: Compare across AZs before enlarging

aws ec2 describe-subnets --filters Name=vpc-id,Values=<vpc-id> \
  --query 'Subnets[].[SubnetId,AvailabilityZone,AvailableIpAddressCount]' --output text

If other subnets have space, spreading the workload is faster than adding CIDR.

Example Root Cause Analysis

An EKS cluster stopped scheduling pods; new pods stuck in ContainerCreating, and the CNI logged InsufficientFreeAddressesInSubnet. The node subnets were /24s (251 usable each).

The subnet showed zero free addresses:

aws ec2 describe-subnets --subnet-ids subnet-REDACTED \
  --query 'Subnets[0].AvailableIpAddressCount' --output text

0

ENI accounting showed the VPC CNI’s warm IP pool, not pods, held most of the space — each node pre-allocated a full ENI’s worth of secondary IPs:

aws ec2 describe-network-interfaces \
  --filters Name=subnet-id,Values=subnet-REDACTED Name=interface-type,Values=interface \
  --query 'length(NetworkInterfaces)' --output text

248

The immediate relief was deleting a batch of orphaned available ENIs from previously terminated nodes, which freed enough IPs to schedule. The durable fix was enabling CNI prefix delegation (ENABLE_PREFIX_DELEGATION=true) so each ENI hands out a /28 prefix instead of individual IPs — drastically raising pod density per address — and adding a second, larger secondary CIDR to the node subnets.

Prevention Best Practices

• Size workload subnets generously (/22–/20); the 5 reserved addresses and warm pools make small subnets exhaust fast, and CIDR is free.
• For EKS, enable VPC CNI prefix delegation and tune WARM_IP_TARGET/MINIMUM_IP_TARGET so nodes do not hoard addresses.
• Sweep for available (orphaned) ENIs on a schedule and delete them to reclaim leaked IPs from old Lambdas, ALBs, and failed launches.
• Spread ASGs and workloads across multiple AZ subnets so one subnet’s exhaustion does not block launches.
• Isolate large fixed consumers (VPC endpoints, NAT, databases) in their own subnets so they do not crowd out compute, and add a secondary VPC CIDR before you run out.

Quick Command Reference

# Free addresses and CIDR for a subnet
aws ec2 describe-subnets --subnet-ids <subnet-id> \
  --query 'Subnets[0].[CidrBlock,AvailableIpAddressCount]' --output text

# What is consuming the ENIs
aws ec2 describe-network-interfaces --filters Name=subnet-id,Values=<subnet-id> \
  --query 'NetworkInterfaces[].[Status,InterfaceType]' --output text | sort | uniq -c | sort -rn

# Orphaned (available) ENIs you can reclaim
aws ec2 describe-network-interfaces \
  --filters Name=subnet-id,Values=<subnet-id> Name=status,Values=available \
  --query 'NetworkInterfaces[].NetworkInterfaceId' --output text

# Delete an orphaned ENI
aws ec2 delete-network-interface --network-interface-id <eni-id>

# Add a secondary CIDR to a VPC
aws ec2 associate-vpc-cidr-block --vpc-id <vpc-id> --cidr-block 10.1.0.0/16

Conclusion

InsufficientFreeAddressesInSubnet means the subnet’s private-IP space is exhausted. The usual root causes:

1. A subnet CIDR that is too small for the workload.
2. The EKS VPC CNI pre-allocating a warm pool of addresses.
3. Leaked/orphaned available ENIs holding IPs.
4. All capacity concentrated in one AZ’s subnet instead of spread.
5. Large fixed consumers (endpoints, NAT, databases) crowding a shared subnet.

Confirm the free count, reclaim orphaned ENIs for immediate relief, then fix it durably — enlarge the subnet, add a secondary CIDR, enable CNI prefix delegation, and spread across AZs so a single subnet’s exhaustion never blocks launches again.