AWS Builder Center

Builder Center

Public vs Private Subnets in AWS: What’s the Difference?

Learn what makes an AWS subnet public or private, how route tables and Internet Gateways control connectivity, and where public and private resources are commonly used.

We'll answer an important AWS question:
What is the difference between a public subnet and a private subnet?
This is one of the most important concepts to understand before designing an AWS VPC.

1. What Is a Public Subnet?

A subnet is considered public when its route table has a route to an Internet Gateway (IGW) for internet-bound traffic.
For example:
1
2
3
4
5
6
7
Public Subnet
↓
Route Table
↓
Internet Gateway
↓
Internet
A common route looks like:
1
0.0.0.0/0 → Internet Gateway
0.0.0.0/0 represents traffic destined for anywhere in IPv4.

2. What Is a Private Subnet?

A private subnet does not have a direct route to an Internet Gateway.
For example:
1
2
3
4
5
Private Subnet
↓
Route Table
↓
No direct Internet Gateway route
Resources in private subnets can still communicate with other networks depending on the routing configuration.
For example, a private application server may need to access the internet for updates without being directly reachable from the internet.
A common solution is a NAT Gateway, which we'll cover in a future article.

3. What Actually Makes a Subnet Public?

A common misconception is:
"If a subnet contains a public IP, it is automatically public."
That's not the right way to think about it.
The key factor is routing.
Consider:
1
2
3
4
5
Subnet
↓
Route Table
↓
0.0.0.0/0 → Internet Gateway
This route provides a path toward the internet.
Therefore, the subnet can be considered public when the relevant routing and addressing configuration supports internet connectivity.

4. Public vs Private Subnet

A simplified architecture might look like:
1
2
3
4
5
6
7
8
9
10
11
12
13
Internet
│
▼
Internet Gateway
│
┌──────┴──────┐
▼ ▼
Public Subnet Private Subnet
│ │
Load Balancer Application
│
▼
Database
A common design is to keep internet-facing components in public subnets while placing application and database resources in private subnets.

5. What Is an Internet Gateway?

An Internet Gateway (IGW) is an AWS VPC component that enables communication between resources in a VPC and the internet when the required routing, addressing, and security configuration is in place.
A simplified view:
1
2
3
4
5
6
7
AWS VPC
│
▼
Internet Gateway
│
▼
Internet
An Internet Gateway is attached to a VPC.
It does not mean that every resource inside the VPC automatically becomes accessible from the internet.
Routing and security controls still matter.

6. Why Use Private Subnets?

Private subnets are useful for resources that should not be directly exposed to the public internet.
For example:
1
2
3
4
5
6
7
8
9
10
Internet
│
▼
Load Balancer
│
▼
Private Application Servers
│
▼
Private Database
This architecture reduces the direct exposure of backend resources.
For example, a database usually does not need to accept connections directly from the public internet.

7. A Real-World Example

Imagine an online shopping application.
We could design it like this:
1
2
3
4
5
6
7
8
9
10
11
12
13
Users
│
▼
Internet
│
▼
Public Load Balancer
│
▼
Private Application Servers
│
▼
Private Database
The user only needs to interact with the application's public entry point.
The backend and database can remain in private subnets.
This is a common pattern for improving security and controlling network access.

8. Public Does Not Mean "Open to Everyone"

This is extremely important.
A public subnet does not mean:
Anyone can access every resource inside it.
Access is also controlled using mechanisms such as:
  • Security Groups
  • Network ACLs
  • Application-level authentication
  • Routing
  • IP addressing
For example, a web server might allow:
1
HTTPS → Port 443
while blocking unwanted traffic.
We'll explore security groups and network ACLs later in this series.

Simple Mental Model

Remember:
1
2
3
4
5
6
7
8
9
10
11
PUBLIC SUBNET
↓
Route to Internet Gateway
↓
Internet connectivity possible

PRIVATE SUBNET
↓
No direct route to Internet Gateway
↓
Not directly internet-facing
And remember:
Public vs private is primarily about routing, not simply whether a resource has a public IP.
# aws-networking# networking# vpc
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article