## AWS load generators deploy in the subnets with the most free IP addresses

AWS Private Locations now try the configured subnets with the most free IP addresses first, so deployments no longer fail with `InsufficientFreeAddressesInSubnet` while other subnets still have room.

This requires the `ec2:DescribeSubnets` permission. Without it, subnets are tried in random order and the Control Plane logs a warning. See the [upgrade guide]({{< ref "/release-notes/private-control-plane/upgrading/to-2026.42.2" >}}).