When you create a Virtual Private Cloud (VPC), it’s like setting up a blank city — wide open and ready to be divided into neighborhoods. These neighborhoods, called subnets, allow you to organize and secure your resources. Think of them as the public-facing streets and private back alleys of your digital city.
Let’s dive deeper into what subnets are, how they work, and how they interact with AWS Availability Zones.
A subnet (short for subnetwork) is a smaller section of your VPC, carved out of your main CIDR block. Subnets allow you to:
Subnets are tied to specific Availability Zones (AZs). AZs are isolated data centers within an AWS region, designed to ensure high availability and fault tolerance. This means:
Mental Model:
Imagine your VPC as a city. Subnets are the neighborhoods within that city:
Subnets are typically classified into two types: public and private. The difference lies in whether their resources can communicate directly with the internet.
Mental Model:
Think of a public subnet as a storefront facing a busy street. Customers (internet users) can easily visit, interact, and leave.
Mental Model:
A private subnet is like the back office of a store. It’s where important internal work happens, but customers (the internet) can’t just walk in.
Subnets are defined within a single Availability Zone (AZ). This means:
10.0.1.0/24
) in AZ us-east-1a
10.0.2.0/24
) in AZ us-east-1b
By distributing your subnets across AZs, you protect your infrastructure from AZ-specific failures, ensuring high availability for your application.
To ensure your application remains operational during an AZ failure, you need redundancy across AZs for both public and private subnets.
Example Setup:
10.0.1.0/24
) in AZ us-east-1a
: Hosts Web Server 1.10.0.2.0/24
) in AZ us-east-1b
: Hosts Web Server 2.10.0.3.0/24
) in AZ us-east-1a
: Hosts Database Replica 1.10.0.4.0/24
) in AZ us-east-1b
: Hosts Database Replica 2.How It Works:
us-east-1a
fails, the load balancer automatically routes traffic to the web server in us-east-1b
.us-east-1b
can take over seamlessly if us-east-1a
goes down.Here’s how to create subnets in the AWS Management Console:
Go to the VPC Dashboard
Click “Create Subnet”
PublicSubnet-1
) for easy identification.Assign a CIDR Block
10.0.0.0/16
, assign 10.0.1.0/24
to the public subnet./24
block provides up to 256 IP addresses, perfect for many use cases.Repeat for Additional Subnets
PrivateSubnet-1
) in a different AZ with a CIDR block like 10.0.2.0/24
.Designate Subnets as Public or Private
Next, we’ll explore CIDR Blocks — the addressing system that defines the range of IP addresses in your VPC and helps organize your network efficiently.