Subnets, Route Tables & Internet Gateways

The difference between a public and a private subnet is not a checkbox. It is routing. A subnet is public because its route table sends internet-bound traffic to an internet gateway, and private because it does not.

This page shows the three-call pattern that wires public routing, how the main route table catches everything you do not explicitly associate, and the routing rules that decide which entry wins.

Recipe

To make a subnet public you need three calls: create a route table, add a default route to an internet gateway, and associate the subnet. This assumes an internet gateway is already attached to the VPC.

# --- Python (boto3) ---
import boto3
 
ec2 = boto3.client("ec2", region_name="us-east-1")
 
rt = ec2.create_route_table(VpcId="vpc-0abc123")
rt_id = rt["RouteTable"]["RouteTableId"]
 
ec2.create_route(
    RouteTableId=rt_id,
    DestinationCidrBlock="0.0.0.0/0",
    GatewayId="igw-0def456",
)
ec2.associate_route_table(RouteTableId=rt_id, SubnetId="subnet-0aaa111")

// --- TypeScript (AWS SDK v3) ---
import {
  EC2Client, CreateRouteTableCommand, CreateRouteCommand, AssociateRouteTableCommand,
} from "@aws-sdk/client-ec2";
 
const ec2 = new EC2Client({ region: "us-east-1" });
 
const rt = await ec2.send(new CreateRouteTableCommand({ VpcId: "vpc-0abc123" }));
const rtId = rt.RouteTable?.RouteTableId;
 
await ec2.send(new CreateRouteCommand({
  RouteTableId: rtId,
  DestinationCidrBlock: "0.0.0.0/0",
  GatewayId: "igw-0def456",
}));
await ec2.send(new AssociateRouteTableCommand({ RouteTableId: rtId, SubnetId: "subnet-0aaa111" }));

The association is the decisive step. Until AssociateRouteTable runs, the subnet still uses the VPC's main route table and has no internet path no matter how many routes the new table holds.

Working Example

A realistic setup has two public subnets (in two AZs) sharing one public route table, and two private subnets left on the main table. Here is the public side wired for both subnets.

# --- Python (boto3) ---
import boto3
 
ec2 = boto3.client("ec2", region_name="us-east-1")
vpc_id, igw_id = "vpc-0abc123", "igw-0def456"
public_subnets = ["subnet-0aaa111", "subnet-0bbb222"]
 
rt = ec2.create_route_table(
    VpcId=vpc_id,
    TagSpecifications=[{"ResourceType": "route-table",
                        "Tags": [{"Key": "Name", "Value": "public-rt"}]}],
)
rt_id = rt["RouteTable"]["RouteTableId"]
ec2.create_route(RouteTableId=rt_id,
                 DestinationCidrBlock="0.0.0.0/0", GatewayId=igw_id)
 
for subnet_id in public_subnets:
    ec2.associate_route_table(RouteTableId=rt_id, SubnetId=subnet_id)
print("public routing wired for", public_subnets)

// --- TypeScript (AWS SDK v3) ---
import {
  EC2Client, CreateRouteTableCommand, CreateRouteCommand, AssociateRouteTableCommand,
} from "@aws-sdk/client-ec2";
 
const ec2 = new EC2Client({ region: "us-east-1" });
const vpcId = "vpc-0abc123", igwId = "igw-0def456";
const publicSubnets = ["subnet-0aaa111", "subnet-0bbb222"];
 
const rt = await ec2.send(new CreateRouteTableCommand({
  VpcId: vpcId,
  TagSpecifications: [{ ResourceType: "route-table",
    Tags: [{ Key: "Name", Value: "public-rt" }] }],
}));
const rtId = rt.RouteTable?.RouteTableId;
await ec2.send(new CreateRouteCommand({
  RouteTableId: rtId, DestinationCidrBlock: "0.0.0.0/0", GatewayId: igwId,
}));
 
for (const subnetId of publicSubnets) {
  await ec2.send(new AssociateRouteTableCommand({ RouteTableId: rtId, SubnetId: subnetId }));
}
console.log("public routing wired for", publicSubnets);

One route table can serve many subnets, so all your public subnets typically share a single public route table. The private subnets need no action here - by staying unassociated they inherit the main route table, which has no internet route.

Deep Dive

The Main Route Table and the Local Route

Every VPC is born with a main route table. Any subnet you never explicitly associate uses it. That default is convenient but dangerous: if you add a 0.0.0.0/0 -> igw route to the main table, every unassociated subnet - including ones you meant to keep private - becomes public at once.

The safe pattern is to keep the main route table private (no internet route) and associate an explicit public route table only to the subnets that should be public.

Every route table also carries an implicit local route: the VPC's own CIDR pointed at target local. It is what lets subnets talk to each other, it is present from creation, and you can neither add nor remove it.

How a Route Is Chosen

When traffic leaves a subnet, AWS picks the route with the most specific matching prefix - longest-prefix-match. A packet to 52.10.0.5 matches both 0.0.0.0/0 and a hypothetical 52.10.0.0/16 route, and the /16 wins because it is more specific.

This is how you carve exceptions: a default route to a NAT gateway plus a more-specific route to a peering connection sends most traffic out via NAT but that one CIDR over the peer.

Replacing and Deleting Routes

Routes are mutable. ReplaceRoute changes the target of an existing destination (for example, failing a private subnet's default route from one NAT gateway to another). DeleteRoute removes a single entry by its destination CIDR. You never edit the local route.

# --- Python (boto3) ---
ec2.replace_route(
    RouteTableId="rtb-0aaa111",
    DestinationCidrBlock="0.0.0.0/0",
    NatGatewayId="nat-0newone",   # repoint the default route
)

// --- TypeScript (AWS SDK v3) ---
import { ReplaceRouteCommand } from "@aws-sdk/client-ec2";
 
await ec2.send(new ReplaceRouteCommand({
  RouteTableId: "rtb-0aaa111",
  DestinationCidrBlock: "0.0.0.0/0",
  NatGatewayId: "nat-0newone",   // repoint the default route
}));

Changing a Subnet's Association

To move a subnet from one route table to another you call ReplaceRouteTableAssociation with the existing association id (found in DescribeRouteTables), not AssociateRouteTable again. Re-associating a subnet that already has an explicit association is what the replace call is for.

Gotchas

• Adding the internet route to the main route table. This silently makes every unassociated subnet public. Keep the main table private and use an explicit public table.
• Forgetting the association. Routes in an unassociated table do nothing. The subnet only gets internet access after AssociateRouteTable.
• No public IP on the instance. A correct route still needs the instance to have a public IP (via MapPublicIpOnLaunch or an Elastic IP). Routing alone is not enough.
• Internet gateway not attached. CreateRoute to an unattached gateway fails or the route black-holes. Attach the gateway to the VPC first.
• Trying to touch the local route. You cannot delete or modify the implicit local route; attempts error.
• Deleting a route table while associated. Disassociate its subnets first, and note you cannot delete the main route table at all.

Alternatives

• A single route table for the whole VPC works for a flat network with no public/private split, but you lose the isolation that separate tables give.
• VPC endpoints with gateway routes (for S3 and DynamoDB) add prefix-list routes to a table so that traffic never touches the internet gateway - covered on the peering/PrivateLink page.
• Transit Gateway replaces a mesh of route tables and peering routes with a hub-and-spoke model once you have many VPCs.
• Infrastructure as code (Terraform, CloudFormation, CDK) declares tables, routes, and associations as resources so the wiring is reproducible instead of imperative.

Use explicit per-tier route tables for anything beyond a toy VPC; reach for Transit Gateway when the number of VPCs makes pairwise routing unmanageable.

FAQs

Related

• VPC via SDK Basics - the end-to-end build these routing calls are part of.
• VPC's Building Blocks, Programmatically - how route tables fit the whole object graph.
• NAT Gateways & Egress-Only Routing - the default route a private subnet uses instead of an internet gateway.
• VPC via SDK Best Practices - keeping the main route table private and tables per tier.

Stack versions: This page was written for boto3 1.43.x (Python 3.10+) and the AWS SDK for JavaScript v3 (Node.js 18+).