How can I restrict the allocation of resources in the subnet assigned to the VPC attachment transit gateway?

Using Subnet CIDR reservation will help us manage this by restricting resource allocation within the /28 subnet.

A subnet CIDR reservation is a range of IPv4 or IPv6 addresses that you set aside so that AWS can't assign them to your network interfaces. This enables you to reserve IPv4 or IPv6 CIDR blocks (also called "prefixes") for use with your network interfaces.

When you create a subnet CIDR reservation, you specify how you will use the reserved IP addresses. The following options are available:

Prefix — AWS assigns addresses from the reserved IP address range to network interfaces. For more information, see Assign prefixes to Amazon EC2 network interfaces in the Amazon EC2 User Guide.

Explicit — You manually assign IP addresses to network interfaces.

First, confirm the transit gateway VPC attachment is properly configured with the /28 subnet.

With only TGW ENIs on this subnet, we’ll create subnet CIDR reservations.

Work with subnet CIDR reservations using the console

To edit subnet CIDR reservations

1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.
2. In the navigation pane, choose Subnets.
3. Select the subnet.
4. Choose the CIDR reservations tab to get information about any existing subnet CIDR reservations.
5. To add or remove subnet CIDR reservations, choose Actions, Edit CIDR reservations and then do the following:
6. To add an IPv4 CIDR reservation, choose IPv4, Add IPv4 CIDR reservation. Choose the reservation type, enter the CIDR
7. range, and choose Add.
8. To add an IPv6 CIDR reservation, choose IPv6, Add IPv6 CIDR reservation. Choose the reservation type, enter the CIDR range, and choose Add.

Note: When you create a subnet CIDR reservation, the IP address range can include addresses that are already in use. Creating a subnet reservation does not unassign any IP addresses that are already in use.

With the subnet CIDR reservations now configured, allocating additional workloads is not possible.

Attempting to create a resource (e.g., EC2) configured for this subnet will fail with this error message.

There are not enough free addresses in subnet 'subnet-ID' to satisfy the requested number of instances.

More information about Subnet CIDR reservations is available in the documentation.