Get available CIDRs from existing VPC I'm writing a few templates to create a stack on demand.
Because of the concurrent VPC limitations (5 to start), I'm attempting to create all the feature-based dev environments on a single VPC and mostly divide the stacks by subnets. The idea is that every stack will have 2 private and 2 public subnets.
I know I can get specific CIDRs with something like this (YAML):

!Select [ 0, !Cidr [ !GetAtt MyVpc.CidrBlock, 1, 8 ]]


But I need to make sure I'm getting CIDRs that are not being used by some of the other stack.
Programmatically, I would get all CIDR blocks from the VPC and then filter all the ones that are used by other subnets, to get a final array (or simply return x items from the array).

Is getting a block of free CIDRs or a single free one something I can do with the intrinsic functions?
Don't worry about putting each stack in its own set of subnets, that's an overkill. 

Simply make the resources' Security Groups refer to other SGs in your stack templates and not to subnet CIDRs. 

What that means is for example the RDS SG sg-123456 will permit traffic from App SG sg-9876543 and not from the App subnet 10.20.30.0/24 you'll be fine from the network isolation perspective.

We usually have the VPC infrastructure shared for dev, test and feature stacks. That's perfectly fine. Moreover we also use CloudFormation Exports to simplify the templates.

Hope that helps :)