🏗️ Terraform Error: 'Error in function call' from cidrsubnet / cidrhost (prefix beyond 32 bits)

Exact Error Message

╷
│ Error: Error in function call
│
│   on network.tf line 8, in locals:
│    8:   subnet = cidrsubnet("10.0.0.0/24", 9, 0)
│
│ Call to function "cidrsubnet" failed: not enough remaining bits in
│ "10.0.0.0/24" to extend prefix to 33 bits.
╵

Related variants from the same family of functions:

│ Call to function "cidrsubnet" failed: prefix extension of 4 does not
│ accommodate a subnet numbered 20.

│ Call to function "cidrhost" failed: prefix of 30 does not accommodate
│ a host numbered 12.

What It Means

cidrsubnet(prefix, newbits, netnum) carves a smaller subnet out of a base CIDR by adding newbits bits to the prefix length and selecting subnet number netnum. cidrhost(prefix, hostnum) returns a single host address inside a prefix. Both functions do exact bitwise math, and IPv4 addresses only have 32 bits.

The error fires when the requested subnet or host cannot physically fit: either the new prefix would exceed 32 bits, or the netnum/hostnum you asked for is larger than the space those bits provide. It is arithmetic, not a provider or network problem — nothing has been created yet.

Common Causes

• newbits is too large: cidrsubnet("10.0.0.0/24", 9, 0) asks for a /33, which is impossible.
• netnum exceeds 2^newbits - 1: with newbits = 4 you get subnets 0–15, so netnum = 20 fails.
• hostnum exceeds the hosts available in the prefix: a /30 holds host numbers 0–3 only.
• Building subnets in a loop where count.index grows past the number of subnets the bits allow.
• Passing an IPv6 assumption into an IPv4 base (or vice versa), so the bit budget is wrong.

Diagnostic Commands

Test the exact call interactively in the Terraform console — this is the fastest way to iterate:

echo 'cidrsubnet("10.0.0.0/24", 9, 0)' | terraform console

Check how many subnets a given newbits yields, and how many hosts a prefix holds:

echo 'pow(2, 4)' | terraform console      # 16 subnets for newbits = 4
echo 'cidrhost("10.0.0.0/30", 3)' | terraform console

Validate the whole configuration to surface every function-call error:

terraform validate

Step-by-Step Resolution

1. Work out your bit budget. Base prefix + newbits must be ≤ 32. A /24 base leaves 8 bits, so newbits can be 1–8, producing a /25 through /32.

2. Pick a newbits that fits and gives you enough subnets. For sixteen /28 subnets from a /24:

locals {
  # /24 + 4 newbits = /28, netnum 0..15 valid
  subnets = [for i in range(16) : cidrsubnet("10.0.0.0/24", 4, i)]
}

3. Keep netnum inside range. The valid maximum is 2^newbits - 1. With newbits = 4 that is 15, so range(16) (0–15) is safe and netnum = 20 is not.

4. For cidrhost, size the prefix to hold the host number. A /30 only has host numbers 0–3; use a larger host space if you need more:

locals {
  gateway = cidrhost("10.0.1.0/24", 1)   # 10.0.1.1, valid in a /24
}

5. If you generate subnets with count/for_each, cap the index to what the bits allow so a growing list cannot overrun:

resource "aws_subnet" "app" {
  count      = min(var.subnet_count, pow(2, var.newbits))
  vpc_id     = aws_vpc.main.id
  cidr_block = cidrsubnet(var.vpc_cidr, var.newbits, count.index)
}

6. Re-run the console check, then validate:

echo 'cidrsubnet("10.0.0.0/24", 4, 15)' | terraform console
terraform validate

Prevention

• Do the bit math up front: base prefix + newbits ≤ 32, and netnum ≤ 2^newbits - 1.
• Prototype every cidrsubnet/cidrhost call in terraform console before wiring it into resources.
• Derive count/loop bounds from pow(2, newbits) so the index can never exceed the subnet space.
• Prefer cidrsubnets() (plural) when you need several differently sized subnets carved in one call.
• Store base CIDRs and newbits in variables with validation blocks to reject impossible combinations early.

Related Errors

• Invalid function argument — the CIDR string itself is malformed (not x.x.x.x/n), a different failure.
• Error in function call from cidrsubnets — the same bit-budget problem across multiple new prefixes.
• Invalid index — indexing past the end of the subnet list you generated, downstream of this issue.
• Call to unknown function — a typo in the function name rather than a math error.

Frequently Asked Questions

Why does cidrsubnet say “33 bits”? You asked for more newbits than the base prefix can spare. /24 plus newbits = 9 totals 33, which exceeds the 32-bit IPv4 limit — lower newbits.

What is the maximum netnum I can use? It is 2^newbits - 1. With newbits = 4 valid subnet numbers are 0 through 15; anything larger raises the “does not accommodate” error.

How is cidrhost different from cidrsubnet? cidrsubnet returns a whole subnet CIDR; cidrhost returns one host IP inside a prefix. Both fail when the number you request exceeds the available address space. You can sketch the right call with a Terraform prompt if the math is fiddly.

Can I avoid the math with a helper? Yes — cidrsubnets(prefix, newbits...) computes several subnets in one call and is easier to reason about for VPC layouts. For more networking-function fixes, see the Terraform guides.