AWS Private Subnets vs Public Subnets

In this short blog post, we're going to tackle a topic that often trips up AWS users, understanding the difference between private and public subnets. If you're just getting started with AWS, terms like 'private' or 'public' subnets will pop up a lot. But, when you actually try to create subnets, you won't find options labeled 'private' or 'public' directly. This can be a bit confusing, right?

The Short Answer - AWS Private vs Public Subnets

If you're already familiar with AWS and are looking for a short answer of 'AWS private vs public subnets', here's your quick answer.

In AWS, a private subnet is all about how it handles Internet-bound traffic. It routes this traffic through a NAT gateway. Instances in a private subnet don’t need to have public IP addresses. The route table associated with the private subnet will have a default route 0.0.0.0/0 pointing to the NAT gateway. If your goal is a truly private subnet, you might even skip adding this default route entirely.

On the flip side, a public subnet works a bit differently. It's got a default route 0.0.0.0/0 that's associated to an Internet Gateway. This setup means that instances in a public subnet do need public IP addresses to communicate with the Internet.

The Long Answer - Diving Deeper into AWS Private vs Public Subnets

While the short answer gives you a quick overview, let's dig a bit deeper into the nuances of AWS private and public subnets. Remember, the key to define whether a subnet is private or public is its route table.

Private Subnets

For example, you might have database instances that shouldn't be directly accessed from the Internet for security reasons. However, these databases still need to be updated regularly, whether it's software patches or package updates. This is where private subnets shine. They allow outbound Internet access (through the NAT gateway) for these updates while keeping inbound traffic blocked. This setup ensures your sensitive data remains secure and inaccessible from the public Internet, yet still maintainable.

Please note that NAT gateway is assigned a public IP address. So, when instances within the private subnet access the Internet, their private IP addresses are NATed (translated) to this public IP.

💡

As I mentioned before, if you need a truly private subnet, you can remove the deault route completely.

Public Subnets

In contrast, public subnets are designed for services that need to interact with the Internet both ways. A typical use case would be hosting web servers. These servers not only need to send data out to the Internet (outbound traffic) but also need to be accessible from the Internet (inbound traffic). This requirement is perfectly met by public subnets. Instances in public subnets have public IP addresses, enabling them to communicate freely with the outside world. This is essential for any service that needs to be publicly accessible, like a company website or an online application.

I hope this would have cleared all the confusion. If you still have any questions, please let them know in the comment section.