PublicVsPrivateSubnets

A public subnet has a route to an Internet Gateway (directly reachable); a private subnet doesn't — that's the entire definition, and it's what determines whether a resource is directly internet-facing.

Why we need this / what value this brings

Getting this boundary wrong in either direction is a real incident: a DB in a public subnet is directly attackable; an app that genuinely needs inbound traffic stuck in a private subnet with no path in just doesn't work.

When to use this

Decide per-resource at provisioning time: does anything need to initiate a connection to this resource from the public internet? If not, private subnet, regardless of whether it needs outbound access.

How to use or implement this

Default every resource to a private subnet; only place something in a public subnet if it must accept unsolicited inbound internet traffic (a load balancer, a bastion host).

Research questions

• Should the EC2 instance running an agent (e.g. under Bedrock AgentCore) sit in a private subnet even though it needs outbound internet access — yes, 'needs outbound access' and 'should be publicly reachable' are different questions. Answered — see Public vs. Private Subnets.