Amazon VPC Quotas

VPCs per Region

5

The quota for internet gateways per Region is directly correlated to this one. Increasing this quota increases the quota on internet gateways per Region by the same amount.

You can have 100s of VPCs per Region for your needs even though the default quota is 5 VPCs per Region.

Subnets per VPC

200

-

IPv6 CIDR blocks per VPC

1

This quota cannot be increased.

Elastic IP addresses per Region

5

This is the quota for the number of Elastic IP addresses for use in EC2-VPC. For Elastic IP addresses for use in EC2-Classic, see Amazon Elastic Compute Cloud Endpoints and Quotas in the Amazon Web Services General Reference.

This quota applies to individual AWS account VPCs and shared VPCs.

Customer gateways per Region

-

For more information, see Site-to-Site VPN Quotas in the AWS Site-to-Site VPN User Guide.

Internet gateways per Region

5

This quota is directly correlated with the quota on VPCs per Region. To increase this quota, increase the quota on VPCs per Region. Only one internet gateway can be attached to a VPC at a time.

Virtual private gateways per Region

-

For more information, see Site-to-Site VPN Quotas in the AWS Site-to-Site VPN User Guide.

Network ACLs per VPC

200

You can associate one network ACL to one or more subnets in a VPC. This quota is not the same as the number of rules per network ACL.

Rules per network ACL

This is the one-way quota for a single network ACL, where the quota for ingress rules is 20, and the quota for egress rules is 20. This quota includes both IPv4 and IPv6 rules, and includes the default deny rules (rule number 32767 for IPv4 and 32768 for IPv6, or an asterisk * in the Amazon VPC console).

This quota can be increased up to a maximum of 40; however, network performance might be impacted due to the increased workload to process the additional rules.

Network interfaces per instance

-

This quota varies by instance type. For more information, see IP Addresses Per ENI Per Instance Type.

Network interfaces per Region

5000

This quota applies to individual AWS account VPCs and shared VPCs.

Route tables per VPC

200

The main route table counts toward this quota.

Routes per route table (non-propagated routes)

50

You can increase this quota up to a maximum of 1000; however, network performance might be impacted. This quota is enforced separately for IPv4 routes and IPv6 routes.

If you have more than 125 routes, we recommend that you paginate calls to describe your route tables for better performance.

BGP advertised routes per route table (propagated routes)

100

This quota cannot be increased. If you require more than 100 prefixes, advertise a default route.

VPC security groups per Region

2500

This quota applies to individual AWS account VPCs and shared VPCs.

If you increase this quota to more than 5000 security groups in a Region, we recommend that you paginate calls to describe your security groups for better performance.

Inbound or outbound rules per security group

60

You can have 60 inbound and 60 outbound rules per security group (making a total of 120 rules). This quota is enforced separately for IPv4 rules and IPv6 rules; for example, a security group can have 60 inbound rules for IPv4 traffic and 60 inbound rules for IPv6 traffic. A rule that references a security group or prefix list ID counts as one rule for IPv4 and one rule for IPv6.

A quota change applies to both inbound and outbound rules. This quota multiplied by the quota for security groups per network interface cannot exceed 1000. For example, if you increase this quota to 100, we decrease the quota for your number of security groups per network interface to 10.

Security groups per network interface

5

The maximum is 15. This quota is enforced separately for IPv4 rules and IPv6 rules. The quota for security groups per network interface multiplied by the quota for rules per security group cannot exceed 1000. For example, if you increase this quota to 10, we decrease the quota for your number of rules per security group to 100.

Active VPC peering connections per VPC

50

The maximum quota is 125 peering connections per VPC. The number of entries per route table should be increased accordingly; however, network performance might be impacted.

Outstanding VPC peering connection requests

25

This is the quota for the number of outstanding VPC peering connection requests that you've requested from your account.

Expiry time for an unaccepted VPC peering connection request

1 week (168 hours)

This quota cannot be increased.

Gateway VPC endpoints per Region

20

You cannot have more than 255 gateway endpoints per VPC.

VPC endpoint policy size

Number of distinct accounts that a VPC can be shared with

100

This is the quota for the number of distinct participant accounts that subnets in a VPC can be shared with. This is a per VPC quota and applies across all the subnets shared in a VPC. To increase this quota, contact AWS Support.

VPC owners can view the network interfaces and security groups that are attached to the participant resources. Therefore, AWS recommends that you paginate your DescribeSecurityGroups and DescribeNetworkInterfaces API calls before requesting an increase for this quota.

This is the quota for maximum number of subnets that can be shared with an AWS account. To increase this quota contact AWS Support. AWS recommends that you paginate your DescribeSecurityGroups and DescribeSubnets API calls before requesting an increase for this quota.