diff --git a/pkg/cloudprovider/aws/subnets.go b/pkg/cloudprovider/aws/subnets.go
index f478e9336ab9..acb615f24cfd 100644
--- a/pkg/cloudprovider/aws/subnets.go
+++ b/pkg/cloudprovider/aws/subnets.go
@@ -52,6 +52,10 @@ func (s *SubnetProvider) Get(ctx context.Context, provisioner *v1alpha1.Provisio
 	if tagKey := constraints.GetSubnetTagKey(); tagKey != nil {
 		subnets = filter(byTagKey(*tagKey), subnets)
 	}
+	// 4. Filter by zones if constrained
+	if len(constraints.Zones) != 0 {
+		subnets = filter(byZones(constraints.Zones), subnets)
+	}
 	return subnets, nil
 }
 
@@ -102,3 +106,14 @@ func byTagKey(tagKey string) func(*ec2.Subnet) bool {
 		return false
 	}
 }
+
+func byZones(zones []string) func(*ec2.Subnet) bool {
+	return func(subnet *ec2.Subnet) bool {
+		for _, zone := range zones {
+			if aws.StringValue(subnet.AvailabilityZone) == zone {
+				return true
+			}
+		}
+		return false
+	}
+}