How to make VPC changes without breaking the stack?

[roybeny]

I wanted to understand the right way to create a VPC and its resources, in a way that later changes will cause the stack to break and without having to delete the entire VPC to apply such changes (details below)
I was surprised to learn that using a very basic stack and applying a small change will result in a failure of the stack due to a conflict in the CIRD block.

I would love to understand the right way to create the resources.

Here is a simple example for creating a simple VPC and then making a change in the subnets of the vpc:

create the vpc with private isolated subnet:

class PersistentVpcTestStack(Stack):

    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        cider_block = '10.18.0.0/16'

        vpc = ec2.Vpc(
            self,
            'TestVpc',
            max_azs=3,
            subnet_configuration=[
                ec2.SubnetConfiguration(
                    name='PrivateIsolated',
                    subnet_type=ec2.SubnetType.PRIVATE_ISOLATED,
                    cidr_mask=24,
                )
            ],
            ip_addresses=ec2.IpAddresses.cidr(cider_block),
            restrict_default_security_group=True,
        )

If I then want to add a public security group, I might change it to this:
The change there is only to update the subnet_configuration to include the public subnet:

        vpc = ec2.Vpc(
            self,
            'TestVpc',
            max_azs=3,
            subnet_configuration=[
                ec2.SubnetConfiguration(
                    name='PublicSubnet',
                    subnet_type=ec2.SubnetType.PUBLIC,
                    cidr_mask=24,
                ),
                ec2.SubnetConfiguration(
                    name="PrivateSubnetWithEgress",
                    subnet_type=ec2.SubnetType.PRIVATE_WITH_EGRESS,
                    cidr_mask=24,
                ),
            ],
            ip_addresses=ec2.IpAddresses.cidr(cider_block),
            restrict_default_security_group=True,
        )

This results in a broken stack since there is a conflict between the CIDR blocks of the existing subnet(s) and one(s) being created.
How should I create the resources to avoid this? or how should apply such changes?

7:55:42 AM | CREATE_FAILED | AWS::EC2::Subnet | TestVpc/PublicSubnetSubnet1/Subnet
Resource handler returned message: "The CIDR '10.18.0.0/24' conflicts with another subnet (Service: Ec2, Status Code: 400, Request ID: e9db5c56-b1e0-4c31-a2dd-25f6fc8ccfe0) (SDK Attempt Co
unt: 1)" (RequestToken: e5d889cc-518d-75c2-94dc-4087c4fe3e03, HandlerErrorCode: AlreadyExists)
7:55:42 AM | CREATE_FAILED | AWS::EC2::Subnet | TestVpc/PublicSubnetSubnet2/Subnet
Resource handler returned message: "The CIDR '10.18.1.0/24' conflicts with another subnet (Service: Ec2, Status Code: 400, Request ID: 2d3e4d89-19cc-466a-97e5-523f15c191ef) (SDK Attempt Co
unt: 1)" (RequestToken: e676da70-b2f4-f895-4195-ebb481e19b95, HandlerErrorCode: AlreadyExists)

Thank you for your help!