Merge pull request #2344 from aiven/dorota-platform-byoc-add-cidr-for…

…mat-guidelines

platform: add CIDR guidelines to the BYOC docs

.github/vale/dicts/aiven.dic

@@ -161,6 +161,7 @@ MongoDB
 MySQL
 myhoard
 namespace/MS
+netmask
 NodeJS
 nosqlbench
 npm

docs/platform/howto/byoc/create-custom-cloud.rst

@@ -472,11 +472,19 @@ In the **Create custom cloud** wizard, proceed as follows:
    * Region
    * CIDR
 
-     Aiven needs CIDR for the `CIDR block of the VPC <https://docs.aws.amazon.com/vpc/latest/userguide/vpc-cidr-blocks.html>`_ that will be created in your AWS account.
+     The **CIDR** block defines the IP address range of the VPC that Aiven creates in your AWS account. Any Aiven service created in the custom cloud will be placed in the VPC and will get an IP address within this address range.
 
-     * Specify inbound rules with the CIDR block notation, for example: 200.1.2.3/32 (allowing 200.1.2.3 as a single address), 0.0.0.0/0 (allowing traffic from anywhere), or 100.1.0.0/16 (allowing traffic from 100.1..).
-     * To create VPC peerings with that VPC, choose a CIDR block that doesn't overlap with CIDR blocks of peer VPCs.
-     * Keep in mind that CIDR block needs be large enough so that, after splitting it into per-region subnets, each subnet has enough addresses to fit required services.
+     In the **CIDR** field, specify an IP address range for the BYOC VPC using a CIDR block notation, for example: ``10.0.0.0/16``, ``172.31.0.0/16``, or ``192.168.0.0/20``.
+
+     Make sure that an IP address range you use meets the following requirements:
+
+     * IP address range is within the private IP address ranges allowed in `RFC 1918 <https://datatracker.ietf.org/doc/html/rfc1918>`_.
+     * CIDR block size is between ``/16`` (65536 IP addresses) and ``/24`` (256 IP addresses).
+     * CIDR block is large enough to host the desired number of services after splitting it into per-availability-zone subnets.
+
+       For example, the smallest ``/24`` CIDR block might be enough for a few services but can pose challenges during node replacements or maintenance upgrades if running low on available free IP addresses.
+
+     * CIDR block of your BYOC VCP doesn't overlap with the CIDR blocks of VPCs you plan to peer your BYOC VPC with. You cannot change the BYOC VPC CIDR block after your custom cloud is created.
 
 2. Select **Next**.