Subnets

What it is
- A subdivision of an Amazon VPC‘s IP range (CIDR block), where you actually place resources.
- Each subnet lives in exactly one Availability Zone — a subnet never spans AZs.
Public vs private
- Public subnet — its route table has a route to an Internet Gateway (IGW). Resources can get a public IP and be reachable from the internet.
- Private subnet — no route to an IGW. Reaches out via a NAT Gateway; not reachable directly from the internet.
Design notes
- Spread subnets across multiple AZs for high availability.
- AWS reserves 5 IP addresses in every subnet (first four + last).
Firewall boundary
- Subnet-level traffic is filtered by network ACLs (stateless); instance-level by security groups (stateful).
Not to be confused with
- The VPC — the whole network. A subnet is one AZ-bound slice of it.

Linked from