After creating VPC subnets 10.1.0.0/16, 10.2.0.0/16, and 10.3.1.0/24, an on-prem DB at 10.2.1.25 stopped receiving traffic. On-prem router advertises 10.0.0.0/8. What is the most likely cause?

The most likely cause is that a more-specific VPC subnet route is taking precedence. When a packet is routed, the most specific route (the one with the longest prefix match) is always preferred. In this scenario, the on-prem router advertises 10.0.0.0/8, which is a broad range. However, a VPC subnet 10.2.0.0/16 was created. This VPC subnet route is more specific than the 10.0.0.0/8 route for any IP address within the 10.2.0.0/16 range, including 10.2.1.25. Therefore, traffic destined for 10.2.1.25 from within the VPC will be routed to the VPC subnet instead of being sent to the on-prem network via the less specific 10.0.0.0/8 route. A less-specific VPC subnet route would not take precedence over a more specific on-prem route. The on-prem router advertising 10.0.0.0/8 means it is advertising a route for the database server's IP, just not specifically enough. A cloud firewall rule blocking traffic would affect all traffic, not just specific routing conflicts.