Private and Public Subnets

A single flat network puts your database one misconfigured security group away from being internet-facing. Deliberately splitting a VPC into public (internet-facing) and private (internal-only) subnets solves this by tiering your architecture: load balancers and bastion hosts sit in public subnets, while application servers and databases sit in private subnets that are never directly reachable from the internet.

• Both subnet types are AZ-specific — a typical tiered design repeats the public/private pair in at least two AZs for high availability.
• Public subnets route 0.0.0.0/0 to an Internet Gateway; private subnets route it to a NAT Gateway (or have no internet route at all if fully isolated).
• Resources in a private subnet can still reach other AWS services privately via VPC endpoints, without ever needing internet access.

graph TD
Internet(("Internet")) --> IGW["Internet Gateway"]
subgraph Pub["Public Subnet"]
  ALB["Load Balancer"]
  NAT["NAT Gateway"]
end
subgraph Priv["Private Subnet"]
  APP["App Servers"]
end
subgraph Iso["Isolated Subnet"]
  DB["Database"]
end
IGW --> Pub
ALB --> APP
APP --> NAT
NAT --> IGW
APP --> DB
classDef alb fill:#f3ecfb,stroke:#8b3de0,stroke-width:2px,color:#3a1a5c
classDef app fill:#e8f0fe,stroke:#3b82f6,stroke-width:2px,color:#173a70
classDef db fill:#fdf0e6,stroke:#e0842e,stroke-width:2px,color:#6b3b0f
class ALB alb
class APP app
class DB db

The subnet split itself is free. Cost lives in what you put in each tier — a NAT Gateway per AZ to give private subnets outbound internet, a Load Balancer in the public tier, and any cross-AZ data transfer between the tiers.

• This 3-tier pattern (public / private / isolated) is the default expected architecture in most AWS SAA scenario questions involving web applications and databases.
• RDS Multi-AZ and similar managed services are typically placed in an isolated subnet (no route to the internet at all, not even via NAT) since they never need outbound internet access.
• A subnet’s public/private status is a route table property, not a fixed attribute — you can change it by editing routes, but doing so mid-flight can unexpectedly expose resources.
• Security Groups (instance-level) and NACLs (subnet-level) are the two extra layers that enforce the tiering inside each subnet, beyond just routing.