Subnet

Concept

A Subnet is one of the smaller parts a VPC is divided into. Each Subnet gets a share of the VPC’s IP addresses, and it sits inside exactly one Availability Zone. A Subnet whose Route Table has a route to an Internet Gateway is called a public subnet. One without that route is called a private subnet. Resources such as EC2 instances or databases are placed inside a Subnet, and a Network ACL controls the traffic of the whole Subnet.

Simple example

There is a house (the VPC). Inside the house there are separate rooms — a living room and a bedroom. Guests can come into the living room, but only family members go into the bedroom.

Why it’s needed

Important things (such as a database) can be kept hidden in a separate room, so the system is more secure.

Where it’s used

There are usually two kinds of subnet:

• Public Subnet = the living room. It can be reached from the internet. For example: a website’s servers, a load balancer.
• Private Subnet = the bedroom. It can’t be reached directly from outside. For example: a database, an internal backend.

Azure equivalent

Azure VNet Subnet

Remember

The VPC is the house, Subnets are the rooms in the house. Each Subnet sits inside only one AZ.

Related

Amazon VPC · Route Table · Availability Zone (AZ)

Learn more

For details and the latest information, see the official documentation:

• Subnet — AWS official documentation ↗