1The Principle of Least Privilege in Networking
A common anti-pattern in cloud deployments is launching application servers and databases in public subnets simply to make SSH access or software updates easier. This exposes critical infrastructure to automated internet port scanners and brute-force attacks. The gold standard of cloud architecture mandates that only load balancers, bastion hosts (jump boxes), or NAT Gateways reside in public subnets. All business logic, microservices, and data stores must be strictly isolated within private subnets.
2Understanding NAT Gateway Cost & Architecture
While NAT Gateways provide elegant outbound internet access for private subnets, architects must be aware of their FinOps implications. AWS charges an hourly rate for each NAT Gateway provisioned, plus a data processing fee per gigabyte transferred. In high-throughput environments, data processing costs can accumulate rapidly. Architects should utilize VPC Gateway Endpoints for Amazon S3 and DynamoDB to route traffic directly over the internal AWS network, bypassing the NAT Gateway entirely and eliminating data transfer fees for AWS service calls.
3Step-by-Step Breakdown
What is a Subnet?. A subnet is a smaller, segmented range of IP addresses within your VPC's overall CIDR block. Subnets allow you to group resources based on security and routing requirements.
Availability Zone Isolation. While a VPC spans an entire AWS Region, every subnet is strictly confined to a single Availability Zone (AZ). To achieve high availability, you must deploy subnets across multiple AZs.
Public Subnets. A subnet is considered 'Public' if its associated route table has a direct route (0.0.0.0/0) pointing to an Internet Gateway (IGW). Instances here can receive public IP addresses.
Private Subnets. A subnet is 'Private' if its route table does NOT have a direct route to an Internet Gateway. Backend servers and databases belong here to prevent direct external access.
The Outbound Internet Dilemma. Instances in private subnets cannot be reached from the internet, but they often need outbound internet access to download software patches or API updates.
Knowledge Check. What architectural configuration defines an AWS subnet as 'Public' rather than 'Private'?
- →Launching an EC2 instance with an Elastic IP address inside the subnet
- →Its associated route table contains a route directing internet-bound traffic (0.0.0.0/0) to an Internet Gateway
- →Attaching a NAT Gateway directly to the subnet's CIDR block
NAT Gateways. A NAT (Network Address Translation) Gateway is a managed AWS service deployed inside a public subnet. It allows instances in private subnets to connect to the internet while blocking incoming external connections.
Configuring Private Route Tables. To enable outbound internet for private instances, you update the private subnet's route table to point 0.0.0.0/0 to the NAT Gateway located in the public subnet.
Public IP Auto-Assign. You can configure a public subnet to automatically assign a public IPv4 address to any EC2 instance launched within it.
Summary & Multi-AZ Architecture. Always deploy at least two public subnets and two private subnets across distinct Availability Zones to ensure maximum fault tolerance and security.
