Skip to content
Shubham JangleResources
Networking

Explore topics

VPC vs Subnet

Watch the walkthrough
Open on Instagram

Watch the video on Instagram

Quick revision

  • VPC (Virtual Private Cloud): your isolated virtual network in AWS. It belongs to one Region and can span multiple Availability Zones (AZs).
  • Subnet: a smaller IP address range inside that VPC. Each subnet belongs entirely to one AZ.
  • Public subnet: its route table has a direct route to an Internet Gateway (IGW).
  • Private subnet: has no direct route to an IGW. It can still have outbound internet access through a public NAT Gateway.

The Region and AZ boundaries above describe AWS VPCs. Other cloud providers use different networking scopes and terminology. See AWS VPC concepts and subnet basics.

Remember the property analogy

Imagine a large private property with wings A, B, and C:

  • The whole property is the VPC.
  • Each wing represents an AZ.
  • Each floor within a wing represents a subnet where you place resources.

The property includes several wings, but one floor cannot belong to two wings. Similarly, a VPC can span AZs, but a subnet cannot.

Example address plan

For a VPC with IPv4 CIDR 10.0.0.0/16:

AZ A: public subnet  10.0.1.0/24
AZ A: private subnet 10.0.2.0/24
AZ B: public subnet  10.0.3.0/24
AZ B: private subnet 10.0.4.0/24

Subnet CIDR ranges must fit inside the VPC's address space and cannot overlap. In a typical AWS IPv4 subnet, five addresses are reserved, so a /24 has 251 usable addresses. See AWS subnet CIDR blocks.

Where resources go

  • Place an internet-facing load balancer in public subnets.
  • Place application servers and databases in private subnets.
  • Deploy across multiple AZs when you need resilience to an AZ failure.

Interview pitfalls

  • Public does not mean automatically exposed. Direct IPv4 internet access also requires a public IPv4 address or Elastic IP, routing, and security rules that permit the traffic. See AWS Internet Gateway requirements.
  • Public/private describes routing, not an IP address naming convention.
  • Subnet placement alone is not a firewall: security groups and network ACLs control permitted traffic.
  • A private subnet can receive application traffic from a public load balancer without accepting direct internet connections.

Recall: VPC = whole network; subnet = one AZ's address range; public/private = route to the IGW.

Continue with Internet Gateway vs NAT Gateway.