The Internet Gateway
A VPC is isolated by default — nothing gets in or out. To allow resources in your VPC to communicate with the public internet, you attach an Internet Gateway (IGW) to the VPC. Think of it as the building's main lobby entrance: it's the single controlled point where traffic crosses between your private network and the public internet.
An Internet Gateway is:
- Horizontally scaled and highly available — the cloud provider manages redundancy for you.
- Stateful — it tracks connection state, so reply traffic is automatically allowed back in.
- Free — you pay for data transfer, not for the gateway itself.
Attaching an IGW to a VPC does not automatically make any subnet public. That's where route tables come in.
Route Tables: The Hallway Signs
Every subnet in a VPC is associated with a route table. A route table is a set of rules (routes) that tell the network where to send traffic destined for a given IP range.
A typical public subnet route table looks like this:
| Destination | Target | Purpose |
|---|---|---|
10.0.0.0/16 |
local | Traffic within the VPC stays local |
0.0.0.0/0 |
igw-xxxxxxxx | Everything else goes to the Internet Gateway |
A private subnet route table looks like this:
| Destination | Target | Purpose |
|---|---|---|
10.0.0.0/16 |
local | Traffic within the VPC stays local |
0.0.0.0/0 |
nat-xxxxxxxx | Outbound internet traffic goes through NAT |
The key difference: public subnets route 0.0.0.0/0 (all internet traffic) to the Internet Gateway. Private subnets route it to a NAT Gateway (or have no internet route at all for fully isolated resources).
What makes a subnet "public"? Three things must all be true:
1. The subnet's route table has a route to an Internet Gateway.
2. Resources in the subnet have public IP addresses (or Elastic IPs).
3. Security groups and network ACLs allow the relevant traffic.
Miss any one of these and the resource is not reachable from the internet, even if you think it's "public."