SAA
VPC Public Subnets and Private Subnets for SAA Candidates
A focused overview of VPC, Public Subnets, Private Subnets, Internet Gateways, and NAT Gateways for the AWS SAA exam.
To answer networking questions on the SAA exam, you need to understand how a VPC, subnets, route tables, Internet Gateways, and NAT Gateways relate to each other.
Summary
A Public Subnet hosts resources that need to be reachable from the internet. A Private Subnet hosts resources that should not be reachable directly from outside.
What is a VPC
A VPC is a virtual network you create on AWS. It is the foundation where you place resources such as EC2, RDS, and ALB.
For a small serverless MVP built only with S3, DynamoDB, Lambda, and API Gateway, you may not need a VPC at all. The contact Lambda on this site only accesses DynamoDB, so a setup without VPC attachment is simpler.
What is a Public Subnet
A Public Subnet is a subnet whose route table has a route to an Internet Gateway. You typically place internet-facing ALBs or bastion-style EC2 instances here.
Note that placing a resource in a Public Subnet does not automatically expose it to the internet. Public IP assignment, route tables, and security groups all play a role.
What is a Private Subnet
A Private Subnet holds resources you do not want reachable directly from the internet. Common examples are application servers and RDS databases.
When an EC2 instance in a Private Subnet needs to make outbound calls (for example, to download updates), you use a NAT Gateway or similar. NAT Gateway tends to add fixed monthly cost, so be careful with it in a personal MVP.
Key points the SAA exam asks
- A Public Subnet has a route to an Internet Gateway
- Resources in a Private Subnet are not directly reachable from the internet
- A NAT Gateway is used for outbound traffic from a Private Subnet
- RDS is generally placed in a Private Subnet
- In a Multi-AZ setup, subnets are also spread across multiple AZs
Practical notes
VPC design is hard to change after the fact. Plan CIDR ranges, subnet splits, AZs, route tables, and security groups carefully from the start.
For a beginner working on personal projects, it is safer to avoid unnecessary VPC attachments and NAT Gateways. If you create them for learning, plan the cleanup steps from the beginning.
Related terms
Read next
What to learn next
Combine blog posts with the AWS glossary, service comparisons, practice questions, and architecture gallery to connect exam knowledge with implementation.