Subnets overlap error when creating

[dougireton]

I'm trying to create a VPC with subnets laid out as follows:

Subnet Type	Availability Zone	CIDR Range	Name
Private	us-gov-west-1a	10.0.0.0/18	private-us-gov-west-1a
Private	us-gov-west-1b	10.0.64.0/18	private-us-gov-west-1b
Private	us-gov-west-1c	10.0.128.0/18	private-us-gov-west-1c
Public	us-gov-west-1a	10.0.192.0/20	public-us-gov-west-1a
Public	us-gov-west-1b	10.0.208.0/20	public-us-gov-west-1b
Public	us-gov-west-1c	10.0.224.0/20	public-us-gov-west-1c

With this Pulumi code, I get errors shown below. I'm not sure how to proceed.

import * as awsx from "@pulumi/awsx";

const vpc = new awsx.ec2.Vpc("portal-staging", {
    cidrBlock: "10.0.0.0/16",
    numberOfAvailabilityZones: 3,
    enableDnsSupport: true,
    enableDnsHostnames: true,
    subnetSpecs:[
        {
            name: "private",
            type: awsx.ec2.SubnetType.Private,
            cidrMask: 18,
        },
        {
          name: "public",
          type: awsx.ec2.SubnetType.Public,
          cidrMask: 20,
        }
    ],
});

export const vpcId = vpc.vpcId;
export const vpcPrivateSubnets = vpc.privateSubnetIds;
export const vpcPublicSubnets = vpc.publicSubnetIds;

> pulumi up
Previewing update (network)

     Type                 Name             Plan       Info
 +   pulumi:pulumi:Stack  network-network  create     2 errors; 13 messages
 +   └─ awsx:ec2:Vpc      portal-staging   create

Diagnostics:
  pulumi:pulumi:Stack (network-network):
    Error: The following subnets overlap with at least one other subnet. Make the CIDR for the VPC larger, reduce the size of the subnets per AZ, or use less Availability Zones:
    1. portal-staging-public-1: 10.0.64.0/20
    2. portal-staging-private-2: 10.0.64.0/18
    3. portal-staging-public-2: 10.0.128.0/20
    4. portal-staging-private-3: 10.0.128.0/18
    : Error: The following subnets overlap with at least one other subnet. Make the CIDR for the VPC larger, reduce the size of the subnets per AZ, or use less Availability Zones:
    1. portal-staging-public-1: 10.0.64.0/20
    2. portal-staging-private-2: 10.0.64.0/18
    3. portal-staging-public-2: 10.0.128.0/20
    4. portal-staging-private-3: 10.0.128.0/18
        at validateSubnets (/snapshot/awsx/bin/ec2/vpc.js:287:15)
        at Vpc.initialize (/snapshot/awsx/bin/ec2/vpc.js:51:9)
        at processTicksAndRejections (node:internal/process/task_queues:96:5)

    error: Error: The following subnets overlap with at least one other subnet. Make the CIDR for the VPC larger, reduce the size of the subnets per AZ, or use less Availability Zones:

    1. portal-staging-public-1: 10.0.64.0/20
    2. portal-staging-private-2: 10.0.64.0/18
    3. portal-staging-public-2: 10.0.128.0/20
    4. portal-staging-private-3: 10.0.128.0/18

        at validateSubnets (/snapshot/awsx/bin/ec2/vpc.js:287:15)
        at Vpc.initialize (/snapshot/awsx/bin/ec2/vpc.js:51:9)
        at processTicksAndRejections (node:internal/process/task_queues:96:5)
    error: Running program '/Users/doug/work/aws/network/bin' failed with an unhandled exception:
    <ref *1> Error: failed to register new resource portal-staging [awsx:ec2:Vpc]: 2 UNKNOWN: The following subnets overlap with at least one other subnet. Make the CIDR for the VPC larger, reduce the size of the subnets per AZ, or use less Availability Zones:

    1. portal-staging-public-1: 10.0.64.0/20
    2. portal-staging-private-2: 10.0.64.0/18
    3. portal-staging-public-2: 10.0.128.0/20
    4. portal-staging-private-3: 10.0.128.0/18

        at Object.registerResource (/Users/doug/work/aws/network/node_modules/@pulumi/runtime/resource.ts:421:27)
        at new Resource (/Users/doug/work/aws/network/node_modules/@pulumi/resource.ts:507:13)
        at new ComponentResource (/Users/doug/work/aws/network/node_modules/@pulumi/resource.ts:1011:9)
        at new Vpc (/Users/doug/work/aws/network/node_modules/@pulumi/ec2/vpc.ts:125:9)
        at file:///Users/doug/work/aws/network/index.ts:3:13
        at ModuleJob.run (node:internal/modules/esm/module_job:194:25) {
      promise: Promise { <rejected> [Circular *1] }
    }