anchor.diff:  ifeval::["{context}" == "installing-aws-china-region"]
   :!aws-china:
   endif::[]
  +ifeval::["{context}" == "installing-aws-vpc"]
  +:!public:
  +endif::[]
   //This should be restricted to the control plane and compute security groups, instead of the current by-VPC-CIDR logic to avoid leaking sensitive Ignition configs to non-cluster entities sharing the VPC.
  
positive.code: * VPC DHCP options
  * VPC endpoints
  
  If you use a custom VPC, you must correctly configure it and its subnets for the installation program and the cluster to use. The installation program cannot subdivide network ranges for the cluster to use, set route tables for the subnets, or set VPC options like DHCP, so you must do so before you install the cluster.
  
  Your VPC must meet the following characteristics:
  
  * The VPC's CIDR block must contain the `Networking.MachineCIDR` range, which is the IP address pool for cluster machines.
  * The VPC must not use the `kubernetes.io/cluster/.*: owned` tag.
  * You must enable the `enableDnsSupport` and `enableDnsHostnames` attributes in your VPC so that the cluster can use the Route 53 zones that are attached to the VPC to resolve cluster's internal DNS records. See link:https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html#vpc-dns-support[DNS Support in Your VPC] in the AWS documentation. If you prefer using your own Route 53 hosted private zone, you must associate the existing hosted zone with your VPC prior to installing a cluster. You can define your hosted zone using the `platform.aws.hostedZone` field in the `install-config.yaml` file.
  
  If you use a cluster with public access, you must create a public and a private subnet for each availability zone that your cluster uses.
  
  The installation program modifies your subnets to add the `kubernetes.io/cluster/.*: shared` tag, so your subnets must have at least one free tag slot available for it. Review the current link:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#tag-restrictions[Tag Restrictions] in the AWS documentation to ensure that the installation program can add a tag to each subnet that you specify.
  
  ifndef::aws-china[]
  If you are working in a disconnected environment, you are unable to reach the public IP addresses for EC2 and ELB endpoints. To resolve this, you must create a VPC endpoint and attach it to the subnet that the clusters are using. The endpoints should be named as follows:
  
negative.code: // * installing/installing_aws/installing-aws-private.adoc
  // * installing/installing_aws/installing-aws-vpc.adoc
  
  ifeval::["{context}" == "installing-aws-china-region"]
  :aws-china:
  endif::[]
  ifeval::["{context}" == "installing-aws-vpc"]
  :public:
  endif::[]
  
  [id="installation-custom-aws-vpc_{context}"]
  = About using a custom VPC
  
  In {product-title} {product-version}, you can deploy a cluster into existing subnets in an existing Amazon Virtual Private Cloud (VPC) in Amazon Web Services (AWS). By deploying {product-title} into an existing AWS VPC, you might be able to avoid limit constraints in new accounts or more easily abide by the operational constraints that your company's guidelines set. If you cannot obtain the infrastructure creation permissions that are required to create the VPC yourself, use this installation option.
  
  