AWS Subnets Explained: Public vs Private Subnets With Examples

Understanding how traffic flows through these isolated network segments is essential for any developer or DevOps engineer managing cloud environments. Public boundaries route inbound and outbound packets through an Internet Gateway, while private boundaries keep internal workloads away from direct public exposure, relying instead on NAT mechanisms for software updates. Establishing proper network boundaries prevents accidental exposure of sensitive backend databases and ensures adherence to modern security compliance standards.

Quick Answer

An AWS subnet is a segment of a VPC's IP address range that groups cloud resources and determines their network accessibility. In modern cloud architectures, subnets are categorized primarily into public and private tiers. Public subnets feature route tables with direct paths to an Internet Gateway, making them suitable for web servers, Application Load Balancers, and public-facing APIs. Private subnets lack direct paths to the internet, shielding sensitive databases, worker nodes, and microservices from external attacks. To allow private resources to fetch updates or call external APIs without accepting inbound connections, administrators deploy NAT Gateways.

When designing a cloud infrastructure, every subnet must reside entirely within a single Availability Zone and cannot span multiple data centers. This localized architecture guarantees that high availability is achieved by replicating identical subnet setups across multiple zones. By combining proper CIDR block planning, distinct route table associations, and multi-zone placement, engineering teams establish secure, scalable cloud environments that isolate public traffic from critical backend data stores.

What Is a Subnet?

At its core, a Virtual Private Cloud functions as a virtual network dedicated to your AWS account, isolated from all other virtual networks in the cloud. However, running all your resources in a single flat network is an administrative and security anti-pattern. To impose order and security boundaries, you divide the VPC into smaller segments known as subnets. Each subnet is assigned a contiguous block of Internet Protocol version 4 addresses, commonly referred to as a CIDR block, which dictates the total number of usable IP addresses available for your cloud instances and container workloads.

AWS reserves specific IP addresses within every CIDR block for internal networking operations. Out of every assigned range, the first four IP addresses and the very last IP address are reserved by AWS and cannot be assigned to individual network interfaces. For instance, if you provision a subnet with a block size of /24, you receive 256 total IP addresses, but only 251 addresses remain usable for your virtual machines, load balancers, or database endpoints. Planning your network architecture requires accounting for these reserved addresses to prevent unexpected IP exhaustion during scaling events.

CIDR Planning

CIDR planning determines the scale, flexibility, and longevity of your cloud infrastructure. When you create a VPC, you typically assign a large Classless Inter-Domain Routing block such as 10.0.0.0/16, which yields 65,536 total IP addresses. You then carve this large address space into smaller, manageable chunks to distribute across different tiers and data centers. For example, dividing the 10.0.0.0/16 VPC block into /24 subnets provides up to 256 addresses per segment, striking a balance between resource density and administrative clarity.

Consider a structured CIDR allocation strategy for a standard three-tier application layout spanning two Availability Zones:

• VPC CIDR Block: 10.0.0.0/16 (65,536 total IPs)
• Public Web Subnet AZ-A: 10.0.1.0/24 (256 IPs)
• Public Web Subnet AZ-B: 10.0.2.0/24 (256 IPs)
• Private App Subnet AZ-A: 10.0.10.0/24 (256 IPs)
• Private App Subnet AZ-B: 10.0.11.0/24 (256 IPs)
• Private DB Subnet AZ-A: 10.0.20.0/24 (256 IPs)
• Private DB Subnet AZ-B: 10.0.21.0/24 (256 IPs)

This deliberate spacing leaves unused gaps in the numbering scheme, allowing engineering teams to easily provision additional subnets for caching layers, monitoring tools, or staging environments later without overlapping existing ranges or forcing a complete network redesign.

Public vs Private Subnets

The distinction between public and private network segments lies entirely in how their associated route tables direct outbound and inbound traffic. A public subnet aws configuration connects directly to the outside world, whereas a private subnet aws deployment remains completely hidden from direct external requests. Understanding this boundary is vital for protecting sensitive application tiers from malicious actors scanning the public internet for vulnerable services.

Public segments host resources that must interact directly with end-users or external web clients, such as frontend web servers, proxy instances, and public load balancers. Conversely, private segments house your application logic, microservices, internal caches, and relational databases. Because these internal assets do not need to accept incoming requests from the public internet, isolating them inside private networks drastically reduces your overall security attack surface.

Public subnet route

A public subnet achieves its external connectivity through a specific configuration rule in its assigned route table. Every subnet in a VPC must be associated with a route table, which contains a set of rules determining where network traffic is directed. For a subnet to be considered public, its route table must contain a default route pointing outward to an Internet Gateway attached to the VPC.

Specifically, the route table must include an entry where the destination is 0.0.0.0/0 (representing all external IPv4 traffic) and the target is the Internet Gateway identifier, typically formatted as igw-xxxxxxxxxxxxxxxxx. When an instance inside this subnet attempts to communicate with an external IP address, the local router consults this route table, matches the packet against the 0.0.0.0/0 rule, and forwards the traffic out through the Internet Gateway. Furthermore, instances within this segment must either have public IPv4 addresses assigned or be fronted by an internet-facing load balancer to receive incoming external connections.

Private subnet route

A private subnet lacks any direct route to an Internet Gateway, meaning external clients on the public internet cannot initiate connections to workloads residing within it. However, workloads inside private segments often need outbound internet access to download operating system patches, pull container images from public registries, or communicate with third-party Software-as-a-Service APIs. To satisfy this requirement securely, cloud architects deploy a Network Address Translation Gateway in a public subnet and configure the private subnet's route table to forward outbound internet traffic to that NAT device.

In this setup, the private subnet route table contains a rule where the destination is 0.0.0.0/0 and the target is the NAT Gateway identifier (nat-xxxxxxxxxxxxxxxxx). When a private instance sends a packet to the internet, the NAT Gateway translates the private source IP address into its own public elastic IP address and forwards the request through the Internet Gateway. When the external response returns, the NAT Gateway reverses the translation and delivers the packet back to the private instance. This architecture ensures outbound connectivity while completely blocking unsolicited inbound traffic from the outside world.

Availability Zones

AWS cloud infrastructure is organized into physical regions around the world, each containing multiple isolated data centers known as Availability Zones. When you design a virtual network, you must distribute your subnets across these distinct Availability Zones to guarantee high availability and fault tolerance. A single subnet can never span multiple AZs; instead, each subnet is bound to one specific data center location.

Mapping your network segments across multiple AZs protects your applications from localized infrastructure failures, such as power outages, hardware malfunctions, or physical network disruptions in a single facility. If you deploy your entire application stack into a single AZ and that data center experiences an outage, your entire service goes offline. By provisioning redundant subnets across two or more AZs and distributing your compute instances evenly among them, your application can automatically absorb a zone failure without dropping user requests.

AZ placement

Effective AZ placement requires balancing traffic load and replication requirements across physical data centers. A standard multi-AZ deployment strategy involves creating identical subnet tiers in at least two distinct zones within the same region. For instance, if you operate in the US East (N. Virginia) region, you might deploy your resources across us-east-1a and us-east-1b.

When planning your AZ placement, consider data transfer costs and cross-zone latency. While AWS optimizes traffic routing between zones within the same region, transferring massive amounts of data—such as high-frequency database replication—across AZ boundaries incurs standard cross-availability zone data transfer fees. Placing active compute instances and their corresponding database read replicas thoughtfully across your subnets helps minimize unnecessary cross-zone chatter while maintaining robust disaster recovery capabilities.

Routing

Network routing in AWS is controlled entirely by route tables, which act as sets of rules determining where network packets are directed. Every subnet in your VPC must be explicitly or implicitly associated with a route table. When you create a new VPC, AWS automatically generates a main route table that is assigned to all newly created subnets by default, though best practices dictate creating custom route tables for granular control over public and private traffic flows.

Every route table contains a local route by default, which enables communication between all resources within the VPC CIDR block across different subnets. You cannot modify or delete this local route. Beyond local communication, administrators add custom entries to route traffic toward Internet Gateways, NAT Gateways, Virtual Private Gateways for VPN connections, or VPC peering connections. Ensuring your route tables are correctly associated with their intended subnets is the single most important step in preventing misconfigured network exposure.

Example Application Layout

A robust, production-grade web application architecture relies on clear separation of concerns across multiple subnet tiers. By deploying a classic three-tier architecture, engineering teams isolate web traffic, business logic, and data storage into dedicated network zones with strict access controls enforced by route tables and security groups.

In this reference layout, public subnets host an Application Load Balancer that receives incoming HTTPS traffic from end-users on the internet. The load balancer distributes these incoming requests across web server instances running in the public subnets or fronting private application nodes. The application tier itself resides entirely within private subnets, ensuring that application code cannot be reached directly from the public internet. These application servers process business logic, call external APIs via a NAT Gateway, and communicate exclusively with backend database instances housed in isolated database subnets.

Common Mistakes

Implementing cloud networks often introduces subtle configuration errors that compromise security or uptime. One of the most frequent and dangerous mistakes is placing backend database servers or internal management tools inside public subnets. Developers sometimes take this shortcut to simplify testing or administrative access, inadvertently exposing sensitive datastores to automated vulnerability scanners and malicious actors on the public internet.

Another common pitfall involves incorrect CIDR block sizing and overlapping network ranges. When setting up VPC peering connections or integrating corporate networks via AWS Direct Connect or VPN, overlapping IP ranges cause catastrophic routing conflicts that break connectivity entirely. Additionally, administrators frequently misconfigure route tables by attaching private subnets directly to Internet Gateways instead of routing outbound traffic through a NAT Gateway, exposing internal workloads or breaking expected connectivity flows.