Inspect the associated table
I want you to read the route table instead of relying on a label such as private-database. Names help people understand intent; actual routes decide the traffic path. Confirm the subnet association as well as the route entry.
Separate subnet type from reachability
An instance still needs suitable addressing and access rules for internet connectivity. Private components can use deliberately designed outbound paths or private service endpoints. Do not reduce an application network to a single public-or-private checkbox.
Include an operating plan
Decide how private components receive updates, reach required services and support administration. Isolation is useful only when the application can still perform its intended work. Document those paths alongside the public user-facing entry point.
Try it yourself
Label all required inbound and outbound connections for a two-tier application. Keep the database away from direct public access.
A common question
Does a public subnet open every instance port?
No. Routing classification does not replace addressing, access controls or application configuration.
References & video notes
Use the video to follow the topic with me. Console screens and older offers can change, so check the current AWS documentation before performing a lab.
Keep learning
- Public and private IP addresses in AWS
- EC2 security groups: allow the right connections
- Elastic IP addresses: when a stable public address helps