The AddressSpaceOverlap error occurs when you attempt to create or peer Azure Virtual Networks (VNets) with overlapping CIDR address ranges. Azure requires all VNets and subnets to have non-overlapping IP address spaces.
This error indicates that the CIDR block you specified for your Virtual Network conflicts with an existing VNet address space. Azure enforces strict IP address space isolation—two VNets cannot have overlapping address ranges if you intend to peer them or connect them via VPN. Each VNet must have a unique, non-overlapping address space (for example, 10.0.0.0/16 and 10.1.0.0/16, not 10.0.0.0/16 and 10.0.1.0/24).
Check which VNets currently exist in your Azure subscription and review their address spaces. Use the Azure portal or run:
az network vnet list --output tableLook for any VNet with an address space that overlaps with the one you are trying to create. For example:
- Existing VNet: 10.0.0.0/16
- Your new VNet: 10.0.5.0/24 (overlaps—falls within 10.0.0.0/16)
Ensure your azurerm_virtual_network resource has a non-overlapping address_space:
resource "azurerm_virtual_network" "example" {
name = "example-vnet"
resource_group_name = azurerm_resource_group.example.name
location = azurerm_resource_group.example.location
address_space = ["10.1.0.0/16"] # Must not overlap with existing VNets
}Common private IP ranges follow RFC 1918:
- 10.0.0.0/8 (large networks)
- 172.16.0.0/12 (medium networks)
- 192.168.0.0/16 (small networks)
If you are peering VNets, confirm that all peered VNets have non-overlapping address spaces. View existing peerings:
az network vnet peering list --resource-group <group-name> --vnet-name <vnet-name>You cannot peer two VNets with overlapping address ranges. If necessary, update the address space of one of the VNets or use VPN Gateway with Network Address Translation (NAT) instead.
Plan your IP address space carefully. Create a spreadsheet or use an IPAM tool to document all VNets and their address ranges:
| VNet Name | Address Space | Region |
|-----------|---------------|--------|
| prod-vnet | 10.0.0.0/16 | eastus |
| dev-vnet | 10.1.0.0/16 | eastus |
| test-vnet | 10.2.0.0/16 | westus |
Update your Terraform configuration to use the new address space:
address_space = ["10.3.0.0/16"]Once you have a non-overlapping address space, run:
terraform plan
terraform applyThe terraform plan output should show the new VNet being created without conflicts. If you still see the AddressSpaceOverlap error, double-check that no other subscription, region, or peered VNet uses the address space you selected.
If you modified an existing VNet's address space, update or recreate any peering connections:
az network vnet peering delete --name <peering-name> --resource-group <group-name> --vnet-name <vnet-name>
az network vnet peering create --name <new-peering> --resource-group <group-name> --vnet-name <vnet-name> --remote-vnet <remote-vnet-id> --allow-vnet-accessVerify the peering is active and both VNets have non-overlapping address spaces.
For hybrid or multi-cloud environments with inherent IP address overlaps, Azure VPN Gateway supports Network Address Translation (NAT) to enable connectivity between overlapping networks without requiring address space changes. Use the NAT feature when you cannot easily change address spaces due to existing infrastructure constraints. Additionally, if you are migrating VMs between VNets due to address space conflicts, remember that Azure does not support direct VM migration between VNets—you must migrate the network interfaces (NICs) by moving VMs to non-overlapping subnets within the same VNet first, or use Azure Site Recovery for complex migrations.
Error: Error installing helm release: cannot re-use a name that is still in use
How to fix "release name in use" error in Terraform with Helm
Error: Error creating GKE Cluster: BadRequest
BadRequest error creating GKE cluster in Terraform
Error: External program failed to produce valid JSON
External program failed to produce valid JSON
Error: Unsupported argument in child module call
How to fix "Unsupported argument in child module call" in Terraform
Error: network is unreachable
How to fix "network is unreachable" in Terraform