This assumes you have already configured the aws command line tool. If not, check out my article on Getting Started with the AWS CLI.

The aws ec2 create-subnet command can be used to create a subnet.

~]$ aws ec2 create-subnet --vpc-id vpc-0a9d4cb29e2748444 --cidr-block 10.0.0.0/28 --availability-zone us-east-1a
{
    "Subnet": {
        "MapPublicIpOnLaunch": false,
        "AvailabilityZoneId": "use1-az1",
        "AvailableIpAddressCount": 251,
        "DefaultForAz": false,
        "SubnetArn": "arn:aws:ec2:us-east-1:123456789012:subnet/subnet-098f977e95180a8ff",
        "Ipv6CidrBlockAssociationSet": [],
        "VpcId": "vpc-0a9d4cb29e2748444",
        "State": "available",
        "AvailabilityZone": "us-east-1a",
        "SubnetId": "subnet-098f977e95180a8ff",
        "OwnerId": "123456789012",
        "CidrBlock": "10.0.0.0/24",
        "AssignIpv6AddressOnCreation": false
    }
}

In this example, since --cidr-block 10.0.0.0/28 was used when creating the subnet, the subnet route table should only have destination 10.0.0.0/24 with target local. In other words, this is a private subnet that has no access to the internet.