Public vs private subnets

beginner

Scenario & brief

A basic three-tier app is wired up wrong: the load balancer isn't reachable, while the app servers and database are exposed to the public internet. That's backwards and dangerous.

By the end, users need to be able to reach the ALB, but the app servers and database should not be directly reachable from the internet — and outbound updates still need to work from wherever they end up.

1,000 rps peakp99 ≤ 200ms99.9% availdurability: standardbudget $200/mo

Load Balancer

Networking

Subnet placement

Allowed ingress (security group)

System health

Erupting · SLA breach

/ 100

Score

SLA not met yet

Monthly cost

$22

Budget $200/mo · within budget

Metrics

Security posture0

Connectivity0

Requirements met0

Requirements

Load balancer is internet-facing — not reachable (need internet-facing)
App servers in a private subnet — public subnet (need private subnet)
Database in a private subnet — public subnet (need private subnet)
Database not reachable from the internet — internet-reachable (need not internet-reachable)
Private subnets egress via NAT — no NAT (need private egress via NAT)

Advisor

Load balancer is internet-facing: Place it in a public subnet with internet ingress so users can reach it.
App servers in a private subnet: Move it to the private subnet.
Database in a private subnet: Move it to the private subnet.
Database not reachable from the internet: Put it in a private subnet, drop the public IP, and don't allow ingress from the internet.
Private subnets egress via NAT: Add a NAT gateway so private-subnet resources can reach the internet for updates without being exposed.

Discussion

No comments yet. Be the first to start the discussion.

For learning purposes only. Costs and capacities are illustrative, not live AWS prices. Not affiliated with or endorsed by Amazon Web Services.