The VPC Context: Public vs Private Subnets
~10 min read
Why a subnet being 'public' or 'private' is a routing decision, not a naming convention.
The VPC Context: Public vs Private Subnets is a Pro topic
Sign in, then upgrade to Pro or Power to unlock this topic and the full AWS curriculum.
Key points
- •Public vs private subnet is determined by the route table, not a label — public has a route to an Internet Gateway
- •Private subnets can't be reached from the internet regardless of Security Group rules, because there's no network path
- •A NAT Gateway (in a public subnet) lets private-subnet instances make outbound calls without accepting inbound ones
- •Standard pattern: load balancers/NAT Gateways in public subnets, app servers and databases in private subnets