When I launch a server with a security group that allows all traffic into my private subnet, it displays a warning that it may be open to the world.

If it is a private subnet, how can that be?

  • 4
    It means that if you were to add an EIP to the instance and the default route were an IGW it would be accessible from the world. The SG would not block the access. – Mark Wagner Nov 20 '13 at 20:31

The main difference is the route for in the associated route table.

A private subnet sets that route to a NAT instance. Private subnet instances only need a private ip and internet traffic is routed through the NAT in the public subnet. You could also have no route to to make it a truly private subnet with no internet access in or out.

A public subnet routes through an Internet Gateway (igw). Instances in a public subnet require public IPs to talk to the internet.

The warning appears even for private subnets, but the instance is only accessible inside your vpc.

  • what makes it so that the instance is only accessible inside your vpc? if i put an instance in a private subnet, what's stopping traffic from outside the vpc to reach it. I saw that by default the vpc network acl permits all traffic – committedandroider May 29 at 22:25
  • 1
    @committedandroider - External traffic can only reach the instance if: It has a public IP assigned, it is on a subnet with the default route for pointed at an internet gateway (aka 'public subnet'), the assigned security group allows the incoming traffic on the specified port from, and if the network ACLs allow the ip/port. If ANY of these are not set correctly, public traffic will not reach the instance. – Jason Floyd May 30 at 3:06

As documented here

PUBLIC SUBNET If a subnet's traffic is routed to an internet gateway, the subnet is known as a public subnet. PRIVATE SUBNETIf a subnet doesn't have a route to the internet gateway, the subnet is known as a private subnet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.