Can't add a secondary CIDR 172.31.120.0/21 to an existing vpc with primary CIDR as 172.31.104.0/21

The failure is caused by two strict VPC networking rules enforced at the API level:

1. The Restricted Default Range

AWS globally restricts adding any secondary CIDR block from the 172.31.0.0/16 range. The VPC API will hard-deny the request, even if your primary CIDR is already located inside that block.

2. RFC 1918 Class Matching

You cannot mix different private IP classes in a single VPC. Since your primary CIDR (172.31.104.0/21) belongs to the 172.16.0.0/12 range, your secondary CIDR must also belong to that exact same range. Attempting to use 10.x.x.x or 192.168.x.x will trigger a class mismatch error.

I would try the following You must choose a CIDR that falls inside the 172.16.0.0/12 range but stays completely outside the restricted 172.31.0.0/16 block. Valid examples for your VPC:

• 172.30.120.0/21
• 172.16.120.0/21 Official AWS Evidence Both rules are explicitly defined in the AWS VPC documentation under IPv4 CIDR block restrictions:
• "You can't add a secondary CIDR block from the 172.31.0.0/16 range."
• "If your VPC has a primary IPv4 CIDR block from an RFC 1918 address range, you can add a secondary IPv4 CIDR block from the same RFC 1918 address range [...] You can't add a secondary CIDR block from a different RFC 1918 address range."

Source: AWS VPC User Guide: VPC CIDR block associations -> https://docs.aws.amazon.com/vpc/latest/userguide/vpc-cidr-blocks.html#vpc-sizing-ipv4

The error you're encountering is actually due to a specific restriction on the 172.31.0.0/16 range. AWS reserves the 172.31.0.0/16 CIDR block for default VPCs, and you cannot add secondary CIDR blocks from this range to any VPC, even if your primary CIDR is already within that range.

Since your primary CIDR (172.31.104.0/21) falls within the reserved 172.31.0.0/16 block, and you're trying to add 172.31.120.0/21 (which also falls within that same reserved range), AWS is blocking this operation.

To resolve this, you have a few options:

1. Use a different private range: Add a secondary CIDR from the 10.0.0.0/8 or 192.168.0.0/16 ranges instead. For example, you could add 10.0.0.0/16 or 192.168.0.0/16 as your secondary CIDR.

2. Use a different part of the 172.16.0.0/12 range: You can use any CIDR from 172.16.0.0/12 through 172.30.255.255/32, just not anything in the 172.31.0.0/16 block. For example, 172.30.0.0/16 would work.

3. Use a publicly routable CIDR: If appropriate for your use case, you can use a publicly routable CIDR block that you own.

The restriction isn't about preventing you from using the same private address class—it's specifically about the 172.31.0.0/16 reservation for default VPCs. Any other part of the RFC 1918 private address space should work fine as a secondary CIDR.