AWS VPC Networking Fundamentals

Explain the difference between public and private subnets in AWS VPC. How do instances in private subnets access the internet?

Junior questions

AWSbeginner

// interview question

Explain the difference between public and private subnets in AWS VPC. How do instances in private subnets access the internet?

Sample answer

Public subnets have a route to an Internet Gateway (IGW), allowing direct internet access for instances with public IPs. Private subnets route internet-bound traffic through a NAT Gateway in a public subnet, enabling outbound-only access. This architecture protects backend services while allowing them to fetch updates and reach external APIs.

Why this matters

VPC subnet design is fundamental to AWS security architecture. The public/private split follows the principle of least exposure - only resources that need direct internet access (load balancers, bastion hosts) go in public subnets, while application servers and databases stay in private subnets.

Code examples

Terraform VPC with public/private subnets

hcl

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

# Public subnet with IGW route
resource "aws_subnet" "public" {
  vpc_id                  = aws_vpc.main.id
  cidr_block              = "10.0.1.0/24"
  map_public_ip_on_launch = true
}

# Private subnet with NAT route
resource "aws_subnet" "private" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.2.0/24"
}

# NAT Gateway in public subnet
resource "aws_nat_gateway" "main" {
  allocation_id = aws_eip.nat.id
  subnet_id     = aws_subnet.public.id
}

Verify subnet routing

bash

# List route tables
aws ec2 describe-route-tables \
  --filters "Name=vpc-id,Values=vpc-xxx" \
  --query 'RouteTables[*].{ID:RouteTableId,Routes:Routes}'

# Check NAT Gateway status
aws ec2 describe-nat-gateways \
  --filter "Name=vpc-id,Values=vpc-xxx"

Common mistakes to avoid

Placing databases in public subnets for convenience
Forgetting to create a NAT Gateway, leaving private instances without internet access
Not using multiple availability zones for NAT Gateway redundancy