Subnets — Public and Private
Inkwell's VPC now has 65,536 addresses, but one big flat network would put the order database on the same footing as the public web server. Subnets let Inkwell carve the VPC into rooms: some with a door to the street, some deliberately without one.
The rule
A subnet is public only if its route table leads to an internet gateway.
A subnet is a slice of the VPC's CIDR block that lives in exactly one Availability Zone. Its block must sit inside the VPC's block and must not overlap any other subnet.
"Public" and "private" are not tick boxes on a subnet. They describe how traffic is routed:
- A public subnet has a route table with a route for
0.0.0.0/0(everywhere) pointing to the VPC's internet gateway. Instances there can talk to the internet directly, if they also have a public IP address. - A private subnet has no such route. Nothing on the internet can start a connection to its instances.
Inkwell's layout, one pair per zone:
10.0.1.0/24 public-1a ap-south-1a
10.0.2.0/24 public-1b ap-south-1b
10.0.11.0/24 private-1a ap-south-1a
10.0.12.0/24 private-1b ap-south-1bThe web servers go in the public subnets; the database goes in the private ones.
An instance in a public subnet still needs a public IPv4 address. The automatically assigned one changes whenever the instance is stopped and started. An Elastic IP is a static public address you keep until you release it, and can move between instances. AWS charges for public IPv4 addresses, whether attached or idle, so release ones you do not need.
The shortcut
For each resource ask "Must strangers on the internet start a conversation with it?" Yes → public subnet. No → private subnet. When unsure, choose private.
Web servers
Shoppers must reach them. Public subnets, one per zone.
The trap: naming a subnet "public" does nothing. If its route table has no route to the internet gateway, it is private however it is labelled; if a "private" subnet gains that route, it is now public.
Drills
Answer fast — trust the rule.
What makes a subnet public?
How many Availability Zones can one subnet span?
Where should Inkwell put its order database?
Inkwell stops and starts a web server that has an automatic public IP. What happens to that address?
Remember
- A subnet lives in one AZ; it is public only if its route table leads to an internet gateway.
- Ask: must strangers start a conversation with it? If not, private.
- Trap: labels do nothing; routes decide. Elastic IPs give a fixed public address, at a charge.