Public and Private Subnets

It is the route table, not a checkbox

A subnet is a slice of the VPC's CIDR block, for example 10.0.1.0/24. Students often believe there is a 'public' switch on a subnet. In AWS there is not. A subnet is public when its route table sends 0.0.0.0/0 (all non-local traffic) to an internet gateway, and the instances in it have public IP addresses. A subnet is private when it has no route to an internet gateway; its instances can still reach the internet outbound through a NAT gateway, but nothing on the internet can start a connection to them. The usual three-tier layout puts only load balancers and perhaps a bastion host in public subnets, application servers in private subnets, and databases in private subnets with even tighter firewall rules. This reduces the attack surface: the fewer things with a path from the internet, the fewer things an attacker can probe.

The three-tier layout

Traffic enters through a public subnet and moves inward. Read it left to right: the internet, a load balancer in a public subnet, application servers in a private subnet, and the database in a private data subnet.

Reception desk and back office

Visitors to an office meet the receptionist in the lobby (public subnet). The receptionist walks requests to staff in the back office (private subnet), and the record room (database) is locked further inside. Visitors never wander into the record room directly.

Public IP alone is not enough

An instance with a public IP in a subnet whose route table has no internet gateway route is still unreachable from the internet. Both conditions are needed: a public address and a route to an internet gateway (plus firewall rules that allow the traffic).

Quick check: What makes an AWS subnet 'public'?

• A route to an internet gateway in its route table
• A tag named Public=true
• A /24 prefix length
• Being in the first Availability Zone