Your count may be off because AWS reserves five IP addresses per subnet CIDR block. The first four IP addresses in a subnet CIDR block and the last IP address in that CIDR block for its internal networking.
For example in a 10.0.0.0/24 subnet AWS will reserve:
10.0.0.0: Network address.
10.0.0.1: Reserved by AWS for the VPC router.
10.0.0.2: Reserved by AWS. The IP address of the DNS server is the base of the VPC network range plus two. For VPCs with multiple CIDR blocks, the IP address of the DNS server is located in the primary CIDR. We also reserve the base of each subnet range plus two for all CIDR blocks in the VPC. For more information, see Amazon DNS server.
10.0.0.3: Reserved by AWS for future use.
10.0.0.255: Network broadcast address. We do not support broadcast in a VPC, therefore we reserve this address.
To get a list of the IP addresses in use from the command line:
aws ec2 describe-network-interfaces --filters Name=subnet-id,Values=<subnet id> |jq -r '.NetworkInterfaces.PrivateIpAddress' |sort
subnet-id filter allows you to exclude the subnets you're not concerned about.
If you want a count just replace
You can visually see the number of IP's free per subnet in the VPC -> Subnet section of the AWS Console.
AWS VPC Subnets