Designing Custom-Mode VPCs and Subnets

Overview and What You Will Learn

In this lab, you will create a custom-mode VPC with subnets in specific regions, compare it against the default auto-mode VPC's behavior, and understand exactly why GCP's global VPC model differs from the regional VPC model used elsewhere.

Why This Matters in Production

An engineer coming from AWS creates a new GCP project, expecting to define a VPC scoped to a single region the way they always have, then discovers the default auto-mode VPC has already created a subnet in every single region worldwide - dozens of subnets nobody asked for, in regions the workload will never touch, each representing unnecessary address space and potential surface area to account for during a security review.

Core Principles

A GCP VPC is a global resource by default - unlike an AWS VPC or Azure VNet, which are both scoped to a single region, a single GCP VPC can span every region, with individual subnets defined per-region inside it.

The default auto-mode VPC that GCP creates automatically for every new project pre-creates a subnet in every available region - convenient for quick experimentation, but rarely appropriate for a production environment where deliberate, minimal address space allocation matters.

Detailed Step-by-Step Practical Lab

1. Create a project and examine its default auto-mode VPC:

2. Delete the default VPC's subnets and the VPC itself, to start from a deliberate, clean state:

3. Create a custom-mode VPC, which starts with zero subnets until you explicitly create them:

4. Add only the specific subnets actually needed:

5. Confirm only these two deliberately created subnets exist, rather than one per region worldwide:

6. Expand a subnet's address range later if it grows too small - a supported, non-disruptive operation as long as the new range doesn't overlap another subnet:

Note

Expanding a subnet's range (here, from a /24 to a larger /23) can only ever grow the range, never shrink it, and the new range must not overlap with any other subnet in the same VPC - plan initial subnet sizes with reasonable headroom to reduce how often this operation is needed.

7. Clean up:

Production Best Practices & Common Pitfalls

Common Mistake

Using the default auto-mode VPC in production, which creates a subnet in every global region automatically whether needed or not. This adds unnecessary complexity and potential exposure compared to a deliberately scoped custom-mode VPC with only the subnets actually needed for the workload.

Tip

Plan subnet CIDR ranges with real headroom from the start - a /24 subnet that turns out too small later can be expanded, but only if the expanded range doesn't collide with a neighboring subnet, which is easier to guarantee if ranges were planned generously to begin with.

• A VPC's global nature means resources in different regions within the same VPC can communicate using private IP addresses by default, without needing VPC peering or a VPN - this is a genuine architectural convenience specific to GCP's model.
• Subnet ranges must not overlap with each other within the same VPC, even across different regions - plan the full address allocation across all planned regions upfront, rather than assigning ranges to each region's subnet independently without checking for collisions.

Quick Reference & Troubleshooting Commands