Search code examples
amazon-web-servicesipamazon-vpcprivate-subnet

What makes a subnet as private in aws


I have some beginner question doubt. I have a subnet whose route table is pointing to internet gateway (0.0.0.0/0). However the public ip address assignation is not enabled. Does that make this as private or public subnet? There are no nat gateway attached. It's just the internet gateway with no public ip assigned to subnet instances. I am aware about the differences between public and private. But the above case seems not so clear for me. What are the exact conditions that makes the subnet as private or public.


Solution

  • All the answers are correct, but I think they do not clearly address your concern yet, so let me take a stab.

    Whether a subnet is private or public depends only on the existence of route to an Internet Gateway. I think you know this.

    Regarding your question:

    However the public ip address assignation is not enabled.

    Does it make the subnet private?

    The answer is no, because during instance launch, you can override the subnet's public IP addressing attribute. You can try to launch an EC2 instance in your subnet. Even though Public IP addressing is not enabled in the subnet, you can still choose to assign a Public IP to the instance.

    Likewise, you can have a public subnet, but your NACL is configured to block traffic to public IPs. Does this make the subnet private?

    The answer is no, because NACL is typically used to allow or deny specific IP and Port ranges. For example, in a public subnet, if you have identified a set of malicious activity coming from certain IPs, you probably want to block them in your NACL. Likewise in a private subnet, you likely don't block traffic to the internet by specifying a deny rule in the NACL. You just don't configure a route to an internet gateway.