Lesson 04 — Public & Private Subnets

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 04 – Amazon VPC & Network Security

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand what Subnets are.
Differentiate between Public and Private Subnets.
Create Subnets using the AWS Console.
Create Subnets using AWS CLI.
Verify Subnet configuration.
Design enterprise network segmentation.

📚 Lesson Information

Estimated Time: 90 Minutes

Difficulty: Beginner

Prerequisites: Lesson 03 – Amazon VPC Fundamentals

Hands-on Lab: Yes

💼 Business Value

A VPC is like an office building.

Subnets are the individual floors.

Not every floor should be accessible to visitors.

Some floors are:

Reception
Meeting Rooms

Others contain:

Finance
HR
Databases

The same applies in AWS.

Applications exposed to customers should be separated from databases and internal services.

This is called Network Segmentation.

🏢 CloudNova Scenario

CloudNova is deploying a new Learning Platform.

The architecture requires:

Internet

↓

Load Balancer

↓

Application Servers

↓

Database

The security team decides:

Load Balancer → Public
Application Servers → Private
Database → Private

🌍 What is a Subnet?

A subnet is a smaller network created inside a VPC.

Every subnet belongs to exactly one Availability Zone.

Example

VPC

10.10.0.0/16

│

├── Public Subnet

10.10.1.0/24

│

├── Private App Subnet

10.10.2.0/24

│

└── Private DB Subnet

10.10.3.0/24

Public vs Private Subnets

Public	Private
Can reach Internet Gateway	No direct Internet access
Hosts Load Balancers	Hosts EC2 Applications
Hosts Bastion Hosts	Hosts Databases
Public IPs allowed	Private IPs only
Customer Traffic	Internal Traffic

🏗 Enterprise Architecture

Internet

│

Internet Gateway

│

──────────────────────

Public Subnet

10.10.1.0/24

↓

Application Load Balancer

↓

──────────────────────

Private App Subnet

10.10.2.0/24

↓

EC2

↓

──────────────────────

Private DB Subnet

10.10.3.0/24

↓

Amazon RDS

🛠 Lab 01 — Create Public & Private Subnets (AWS Console)

Step 1

Open

AWS Console

↓

VPC

Step 2

Select

Your VPC

10.10.0.0/16

Step 3

Navigate to

Subnets

↓

Create Subnet

Step 4

Create Public Subnet

Example

Setting	Value
Name	Public-Subnet-A
VPC	CloudNova-VPC
Availability Zone	ap-south-1a
IPv4 CIDR	10.10.1.0/24

Click

Create Subnet

Step 5

Create Private Application Subnet

Setting	Value
Name	Private-App-A
Availability Zone	ap-south-1a
CIDR	10.10.2.0/24

Step 6

Create Private Database Subnet

Setting	Value
Name	Private-DB-A
Availability Zone	ap-south-1a
CIDR	10.10.3.0/24

✅ Verify

You should now have

Public-Subnet-A

Private-App-A

Private-DB-A

💻 AWS CLI Lab

List VPCs

aws ec2 describe-vpcs

Create Public Subnet

aws ec2 create-subnet \
  --vpc-id vpc-xxxxxxxx \
  --cidr-block 10.10.1.0/24 \
  --availability-zone ap-south-1a

Create Private App Subnet

aws ec2 create-subnet \
  --vpc-id vpc-xxxxxxxx \
  --cidr-block 10.10.2.0/24 \
  --availability-zone ap-south-1a

Create Private Database Subnet

aws ec2 create-subnet \
  --vpc-id vpc-xxxxxxxx \
  --cidr-block 10.10.3.0/24 \
  --availability-zone ap-south-1a

List Subnets

aws ec2 describe-subnets

Filter by VPC

aws ec2 describe-subnets \
  --filters Name=vpc-id,Values=vpc-xxxxxxxx

View Subnet Details

aws ec2 describe-subnets \
  --subnet-ids subnet-xxxxxxxx

Add Name Tags

Public

aws ec2 create-tags \
  --resources subnet-xxxxxxxx \
  --tags Key=Name,Value=Public-Subnet-A

Private App

aws ec2 create-tags \
  --resources subnet-yyyyyyyy \
  --tags Key=Name,Value=Private-App-A

Private DB

aws ec2 create-tags \
  --resources subnet-zzzzzzzz \
  --tags Key=Name,Value=Private-DB-A

Verify from AWS Console

Navigate to

VPC

↓

Subnets

Confirm:

✅ Correct CIDR

✅ Correct AZ

✅ Correct VPC

✅ Correct Name Tags

🔍 Troubleshooting

Problem

Subnet CIDR overlaps

Solution

Use a different CIDR block.

Problem

Wrong Availability Zone

Solution

Delete and recreate the subnet in the correct AZ.

Problem

Created in wrong VPC

Solution

Delete the subnet and recreate it in the correct VPC.

🏢 Enterprise Notes

CloudNova standards:

One subnet per Availability Zone.
Never place databases in Public Subnets.
Public Subnets host only internet-facing components.
Production databases remain in Private Database Subnets.
Use consistent naming conventions.
Tag every subnet with Owner, Environment and Cost Centre.

🚫 Common Mistakes

❌ Using overlapping CIDR blocks.

❌ Putting databases in Public Subnets.

❌ Deploying everything in one subnet.

❌ Ignoring Availability Zones.

❌ Forgetting resource tags.

🧪 DIY Challenge

Using your own AWS account:

Create:

CloudNova-VPC

↓

Public-Subnet-A

10.10.1.0/24

↓

Private-App-A

10.10.2.0/24

↓

Private-DB-A

10.10.3.0/24

Verify:

All three subnets exist.
Each subnet belongs to the same VPC.
Each subnet has the correct CIDR.
Each subnet is tagged correctly.

Take screenshots of:

VPC Dashboard
Subnets page
Subnet Details
AWS CLI output (describe-subnets)

📊 Knowledge Check

What is a subnet?
What is the difference between a Public and Private Subnet?
Can one subnet span multiple Availability Zones?
Why should databases be placed in Private Subnets?
Which AWS CLI command lists all subnets?
Why is network segmentation important?
What happens if two subnets have overlapping CIDR blocks?
Why should resources be tagged?
Which subnet should host an internet-facing Application Load Balancer?
How do subnets improve security?

💡 Key Takeaways

After completing this lesson, you should understand:

Subnets divide a VPC into smaller, manageable network segments.
Public Subnets host internet-facing resources, while Private Subnets protect internal workloads.
Every subnet belongs to a single Availability Zone.
Proper subnet design improves security, scalability and operational management.
Cloud Security Engineers use both the AWS Console and AWS CLI to create, manage and verify subnets in enterprise environments.

🚀 Next Lesson

➡️ Lesson 05 — Route Tables