Amazon VPC basics: public vs private subnets, NAT gateway
A VPC is a logically isolated virtual network for your AWS resources, divided into subnets that each sit in one Availability Zone. A subnet is public if its route table has a direct route to an internet gateway, and private if it does not. A NAT gateway lets instances in a private subnet connect out to the internet while blocking connections started from outside.
VPCs, subnets and route tables
Amazon VPC lets you launch AWS resources in a logically isolated virtual network that you define. It resembles a traditional network in your own data center.
A subnet is a range of IP addresses in your VPC. Each subnet is entirely within one Availability Zone and cannot span zones. To protect an application from one zone failing, put resources in subnets in separate zones.
Each subnet is associated with a route table, which specifies where outbound traffic from the subnet goes. Every account has a default VPC in each Region, set up so you can launch EC2 instances right away. There is no additional charge for using a VPC, but some components, such as NAT gateways, have charges.
Public and private subnets
The subnet type comes from its routing. A public subnet has a direct route to an internet gateway, so its resources can access the public internet. A private subnet has no such route, and its resources need a NAT device to reach the internet.
A VPN-only subnet has a route to a Site-to-Site VPN connection through a virtual private gateway and no route to an internet gateway. An isolated subnet has no routes outside the VPC.
AWS recommends private subnets to protect your resources.
Internet gateway vs NAT gateway
An internet gateway is a horizontally scaled, redundant and highly available VPC component that allows communication between your VPC and the internet. Traffic can go both ways: resources on the internet can start a connection to an instance in a public subnet that has a public IPv4 or IPv6 address. There is no charge for the internet gateway itself.
A default VPC comes with an internet gateway. A VPC you create does not, so you attach one and add a route to it.
A NAT gateway lets instances in a private subnet connect to services outside the VPC, while external services cannot start a connection with those instances. A public NAT gateway sits in a public subnet with an Elastic IP address and sends its traffic to the internet through the VPC's internet gateway.
Where the exam catches people
Believing a subnet is public because of a setting on the subnet: it is public because its route table has a direct route to an internet gateway.
Believing a subnet can span Availability Zones: each subnet is entirely within one zone.
Believing a NAT gateway lets the internet reach private instances: it allows outbound connections only, and outside services cannot start a connection.
Believing every VPC comes with an internet gateway: a default VPC has one, but a VPC you create does not.
Believing an instance with a public IP in a private subnet can reach the internet: without a route to the internet gateway it cannot.