Public vs private subnets in AWS - Hands-On Comparison

Create a VPC with Public and Private Subnets in AWS

📋 What You'll Learn

💡 Why This Matters

🌍 Real World

This setup is common for web applications where web servers need internet access but databases should be protected in private subnets.

💼 Career

Understanding public vs private subnets and routing is essential for cloud architects and network engineers working with AWS networking.

1

Create the VPC and Subnets

Create a VPC called my_vpc with CIDR block "10.0.0.0/16". Then create two subnets: a public subnet called public_subnet with CIDR block "10.0.1.0/24" and a private subnet called private_subnet with CIDR block "10.0.2.0/24". Use the AWS CloudFormation resource types AWS::EC2::VPC and AWS::EC2::Subnet.

AWS

# Your code here to create my_vpc, public_subnet, and private_subnet

Hint

Use AWS::EC2::VPC to create the VPC and AWS::EC2::Subnet to create each subnet. Remember to link subnets to the VPC using VpcId.

2

Create and Attach the Internet Gateway

Create an internet gateway called internet_gateway using AWS::EC2::InternetGateway. Then attach it to the VPC my_vpc using AWS::EC2::VPCGatewayAttachment.

AWS

Resources:
  my_vpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: "10.0.0.0/16"
      Tags:
        - Key: Name
          Value: my_vpc
  public_subnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref my_vpc
      CidrBlock: "10.0.1.0/24"
      Tags:
        - Key: Name
          Value: public_subnet
  private_subnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref my_vpc
      CidrBlock: "10.0.2.0/24"
      Tags:
        - Key: Name
          Value: private_subnet

# Your code here to create internet_gateway and attach it to my_vpc

Hint

Use AWS::EC2::InternetGateway to create the internet gateway and AWS::EC2::VPCGatewayAttachment to attach it to the VPC.

3

Create Route Tables and Routes

Create a public route table called public_route_table for my_vpc using AWS::EC2::RouteTable. Add a route called public_route that sends all traffic (0.0.0.0/0) to the internet_gateway. Also create a private route table called private_route_table for my_vpc without any internet route.

AWS

Resources:
  my_vpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: "10.0.0.0/16"
      Tags:
        - Key: Name
          Value: my_vpc
  public_subnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref my_vpc
      CidrBlock: "10.0.1.0/24"
      Tags:
        - Key: Name
          Value: public_subnet
  private_subnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref my_vpc
      CidrBlock: "10.0.2.0/24"
      Tags:
        - Key: Name
          Value: private_subnet
  internet_gateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: internet_gateway
  attach_igw:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref my_vpc
      InternetGatewayId: !Ref internet_gateway

# Your code here to create public_route_table, public_route, and private_route_table

Hint

Create two route tables. The public one needs a route to the internet gateway for all traffic. The private one has no routes to the internet.

4

Associate Subnets with Route Tables

Associate the public_subnet with the public_route_table using AWS::EC2::SubnetRouteTableAssociation called public_subnet_assoc. Also associate the private_subnet with the private_route_table using AWS::EC2::SubnetRouteTableAssociation called private_subnet_assoc.

AWS

Resources:
  my_vpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: "10.0.0.0/16"
      Tags:
        - Key: Name
          Value: my_vpc
  public_subnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref my_vpc
      CidrBlock: "10.0.1.0/24"
      Tags:
        - Key: Name
          Value: public_subnet
  private_subnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref my_vpc
      CidrBlock: "10.0.2.0/24"
      Tags:
        - Key: Name
          Value: private_subnet
  internet_gateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: internet_gateway
  attach_igw:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref my_vpc
      InternetGatewayId: !Ref internet_gateway
  public_route_table:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref my_vpc
      Tags:
        - Key: Name
          Value: public_route_table
  public_route:
    Type: AWS::EC2::Route
    DependsOn: attach_igw
    Properties:
      RouteTableId: !Ref public_route_table
      DestinationCidrBlock: "0.0.0.0/0"
      GatewayId: !Ref internet_gateway
  private_route_table:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref my_vpc
      Tags:
        - Key: Name
          Value: private_route_table

# Your code here to associate public_subnet with public_route_table and private_subnet with private_route_table

Hint

Use AWS::EC2::SubnetRouteTableAssociation to link each subnet to its route table.

Practice

1. Which statement best describes a public subnet in AWS?

easy

A. It has direct internet access and assigns public IPs automatically.

B. It does not assign public IPs and blocks all internet traffic.

C. It is used only for internal communication within the VPC.

D. It requires a VPN connection to access the internet.

Solution

1. Step 1: Understand public subnet characteristics

   A public subnet allows resources to communicate directly with the internet by assigning public IP addresses.

2. Step 2: Compare with other subnet types

   Private subnets do not assign public IPs and restrict internet access, unlike public subnets.

3. Final Answer:

   It has direct internet access and assigns public IPs automatically. -> Option A

4. Quick Check:

   Public subnet = direct internet access [OK]

Hint: Public subnet = direct internet access + public IPs [OK]

Common Mistakes:

• Confusing private subnet with public subnet
• Thinking all subnets have internet access
• Assuming VPN is needed for public subnet

2. Which AWS subnet configuration correctly creates a private subnet?

easy

A. AssignPublicIpOnLaunch: true

B. EnableInternetGateway: true

C. MapPublicIpOnLaunch: false

D. RouteTable: 0.0.0.0/0 via IGW

Solution

1. Step 1: Identify private subnet IP assignment

   Private subnets do not assign public IPs automatically, so MapPublicIpOnLaunch must be false.

2. Step 2: Understand routing and gateway settings

   Internet Gateway (IGW) and routing to 0.0.0.0/0 are for public subnets, not private.

3. Final Answer:

   <code>MapPublicIpOnLaunch: false</code> -> Option C

4. Quick Check:

   Private subnet = no public IP assignment [OK]

Hint: Private subnet disables public IP assignment [OK]

Common Mistakes:

• Setting public IP assignment to true for private subnet
• Confusing internet gateway with subnet config
• Using public route table for private subnet

3. Given this route table for a subnet:
Destination: 0.0.0.0/0, Target: igw-12345
What type of subnet is this likely to be?

medium

A. Public subnet with internet access

B. Private subnet with no internet access

C. Isolated subnet with VPN only

D. Subnet with NAT gateway only

Solution

1. Step 1: Analyze route table destination and target

   The route directs all internet traffic (0.0.0.0/0) to an internet gateway (igw), which enables internet access.

2. Step 2: Determine subnet type from routing

   Routing to an internet gateway means the subnet is public and can access the internet directly.

3. Final Answer:

   Public subnet with internet access -> Option A

4. Quick Check:

   Route to IGW = public subnet [OK]

Hint: Route 0.0.0.0/0 to IGW means public subnet [OK]

Common Mistakes:

• Assuming NAT gateway means public subnet
• Confusing IGW with VPN or NAT
• Ignoring route table targets

4. You created a subnet with MapPublicIpOnLaunch: false but instances still get public IPs. What is the likely issue?

medium

A. The subnet is associated with a route table that routes to an internet gateway.

B. The instance launch configuration overrides subnet settings to assign public IPs.

C. The VPC has no internet gateway attached.

D. The subnet CIDR block overlaps with another subnet.

Solution

1. Step 1: Understand subnet vs instance IP assignment

   Subnet setting disables automatic public IP assignment, but instance launch settings can override this.

2. Step 2: Identify cause of public IP despite subnet config

   If instance launch config explicitly assigns public IPs, it overrides subnet default behavior.

3. Final Answer:

   The instance launch configuration overrides subnet settings to assign public IPs. -> Option B

4. Quick Check:

   Instance config can override subnet IP assignment [OK]

Hint: Instance launch config can override subnet IP settings [OK]

Common Mistakes:

• Blaming route table for IP assignment
• Ignoring instance-level settings
• Confusing CIDR overlap with IP assignment

5. You want to host a web server accessible from the internet and a database only accessible internally. How should you design your subnets?

hard

A. Place both web server and database in private subnets and use a VPN for access.

B. Place both web server and database in a public subnet with security groups restricting access.

C. Place the web server in a private subnet and the database in a public subnet.

D. Place the web server in a public subnet and the database in a private subnet.

Solution

1. Step 1: Identify subnet roles for internet access

   The web server needs internet access, so it belongs in a public subnet with a route to the internet gateway.

2. Step 2: Secure the database internally

   The database should be in a private subnet without direct internet access to keep it secure.

3. Final Answer:

   Place the web server in a public subnet and the database in a private subnet. -> Option D

4. Quick Check:

   Internet-facing resources in public, internal in private [OK]

Hint: Web server public, database private subnet [OK]

Common Mistakes:

• Putting database in public subnet
• Putting web server in private subnet
• Relying only on security groups without subnet design