MediumExperience level: 3-5 years · 8-15 years1 min read

How do you design a VPC with public and private subnets?

Reviewed by Gurusankar M.

Asked inAmazonMicrosoftDeloitte
#vpc#subnets#nat gateway#internet gateway#network design
Report issue

Short Answer

Split into public subnets (route to an Internet Gateway — for load balancers/bastions) and private subnets (no direct internet; outbound via a NAT Gateway — for app servers/DBs). Spread subnets across AZs. Keep databases in private subnets, reachable only from the app tier's Security Group.

On this page

Concept Made Simple

Coffee Chat Question

“How do you design a VPC with public and private subnets?”

Remember It Faster

Mind Map Answer

Public subnet
route to IGW — ALB, bastion
Private subnet
no inbound internet — app, DB
NAT Gateway
private → outbound internet only
Multi-AZ
subnets in each AZ

Think Beyond the Expected

What If?

A private-subnet service needs to call an external API but has no internet route — how?

Route its outbound traffic through a NAT Gateway in a public subnet — it gets internet egress without being reachable from the internet. For AWS services specifically (S3/DynamoDB), a VPC endpoint keeps traffic on the AWS network and avoids NAT cost.

Real World

The public/private subnet + NAT + multi-AZ layout is the canonical VPC design; putting databases in private subnets with SG-restricted access is baseline security.

Interviewer's Expectation

Keywords they're listening for:

  • public vs private subnets
  • IGW vs NAT Gateway
  • DBs in private subnets
  • multi-AZ subnets
  • VPC endpoints

Common Mistakes

  • Databases in public subnets
  • No NAT for private outbound
  • Single-AZ subnets (no HA)

Best Practices

  • Private subnets for app/data tiers
  • NAT for egress; VPC endpoints for AWS services
  • Subnets across multiple AZs

Follow-up Questions

  1. NAT Gateway vs VPC endpoint for S3 access?
  2. Why place databases in private subnets?
  3. How do route tables enforce this?

Continue Learning with AI

Take this question deeper with your favourite AI assistant. Pick a depth, copy the prompt, or open it directly — AI is your learning companion, not a shortcut.

Plain-language foundations

I'm preparing for a software engineering interview and want to understand this from scratch, as a beginner.

Topic: VPC (AWS)
Interview question: "How do you design a VPC with public and private subnets?"

Please:
1. Explain the core idea in simple, plain language, using an everyday analogy.
2. Define any technical terms you use.
3. Walk through one small, concrete example.
4. Finish with a single sentence I can easily remember.

Keep the tone friendly and assume I'm new to this topic.
Open inChatGPTGeminiClaude

Was this answer helpful?

Affiliate links

Tools for Your Developer Workspace

Equipment for a comfortable, productive setup.

As an Amazon Associate I earn from qualifying purchases.