Public Subnet vs Private Subnet
Compare internet-routable subnet placement with isolated internal subnet placement in AWS.
Networking
Public Subnet
A public subnet is a subnet whose route table allows direct routing to an Internet Gateway. Resources in public subnets can be directly internet-routable when configured appropriately.
Networking
Private Subnet
A private subnet is a subnet that does not provide direct inbound internet routing for its resources. It is typically used for internal services, application layers, and databases.
Key Differences
Public subnets allow direct routing to the internet through an Internet Gateway, while private subnets do not expose resources directly to inbound internet access.
Public subnets are commonly used for entry-point components such as load balancers or bastion access patterns, while private subnets are commonly used for application servers and databases.
Private subnets improve security posture by reducing direct exposure, while public subnets are necessary when direct internet-facing access is required.
Resources in private subnets can still access the internet outbound through NAT-based designs without becoming directly reachable from the internet.
The subnet choice is about exposure and routing design, not just arbitrary network segmentation.
Most mature architectures use both public and private subnets together for layered security and traffic flow control.
When to Use
When to use Public Subnet
Use public subnets for internet-facing load balancers, controlled public entry points, or components that must be directly reachable from the internet.
When to use Private Subnet
Use private subnets for internal application tiers, background workers, databases, and services that should not be directly internet-accessible.
Tradeoffs
Public subnets enable direct reachability, but increase exposure and require stronger edge security controls.
Private subnets reduce direct attack surface, but require additional routing patterns such as NAT for outbound access when needed.
A balanced architecture usually exposes only what must be public and keeps most workloads private.
Common Mistakes
Putting databases or sensitive internal services into public subnets unnecessarily.
Assuming private subnets mean no internet access at all, rather than no direct inbound exposure.
Designing all workloads in public subnets because it seems simpler initially.
Interview Tip
The short answer is: public subnets are internet-routable, private subnets are for internal workloads with no direct inbound internet exposure.