Intermediate 18 min read

Public and Private Subnets

By the end of this lesson, you'll be able to:

Explain what actually makes a subnet "public" versus "private" — routing, not just a label
Describe what a public subnet needs beyond just a name to genuinely support internet-facing resources
Describe what a private subnet can and cannot do with respect to internet connectivity

Prerequisites: "Amazon VPC and CIDR Basics"

A subnet is a smaller range carved out of the VPC

Recall Lesson 1's CIDR relationship: a VPC's larger range (like the fictional 10.0.0.0/16) is divided into smaller subnet ranges (like 10.0.1.0/24). Each subnet lives inside exactly one Availability Zone — this is how a VPC's resources end up spread across multiple AZs for resiliency, the same reasoning Module 1 introduced for AZs generally.

What actually makes a subnet public — it's not just the name

This is worth stating precisely, because "public subnet = has a public IP" is an oversimplification worth avoiding: a subnet becomes effectively public when its route table sends internet-bound traffic to an Internet Gateway, and the resources inside it are configured with suitable addressing to actually be reached. Naming a subnet "public-subnet-1" changes nothing about its actual behavior — routing and resource configuration are what matter.

Diagram showing a public subnet's route table sending internet-bound traffic to an Internet Gateway to reach a load balancer, alongside a private subnet with no such route, whose application server or database cannot be reached directly from the internet. — A subnet isn't public merely because of its label — its route table and its resources' configuration are what actually decide.

Private subnets: no direct inbound route, not "no internet at all"

A private subnet has no route sending traffic from the internet directly to it through an Internet Gateway — nothing outside the VPC can initiate a connection straight to a resource inside it. This is exactly where an application server or a database (Module 5's subject) typically belongs, since neither should be directly reachable from the internet.

This doesn't mean a private subnet's resources are cut off from the internet entirely, though — Lesson 4 covers exactly how a private resource can still initiate outbound access when it genuinely needs to.

Exercise

A colleague says "our subnet is private because we named it private-subnet-1." Using this lesson's distinction, explain what actually determines whether a subnet behaves as private, regardless of its name.

Show hint

The name is just a label — think about what the route table for that subnet actually contains.

Public and Private Subnets Quiz

1. What actually determines whether a subnet behaves as public rather than private?

Its route table sends internet-bound traffic to an Internet Gateway, and its resources are configured with suitable addressing Whichever name is given to the subnet when it is created Whether the subnet is the first one created in the VPC Whether the subnet contains a database

2. A subnet is public simply because it has been named "public" in the AWS Console.

True False

3. A subnet that routes internet-bound traffic through an Internet Gateway is commonly described as a ______ subnet.

Show hint

This is the opposite of the subnet type a database typically belongs in.

My Notes

Questions about this lesson

No questions yet — be the first to ask.

Summary

A subnet is public or private based on what its route table actually allows, not merely because of how it's labeled — a public subnet routes internet-bound traffic through an Internet Gateway and can support internet-facing resources, while a private subnet has no such inbound route, though it may still reach the internet outbound through NAT, covered next.

❬ Previous Next ❭