World map

 

BM

World A3: The Mall's Roads

Public and private subnets

You will learn: to split your VPC into public and private rows, one per wing.

Checked with AWS 2026-11 on 1 Nov 2026

The problem

Kedai Kancil’s order database sits in the row that faces the street. Strangers walk past it all day. Where should it live?

Watch

A Subnet: One row of units inside your VPC, in one wing (Availability Zone). It gets part of the VPC's addresses. is one row of units in one wing. Public rows face the street. Private rows are back rooms. Sort Kedai Kancil’s parts.

Drag a card into a box. Or tap the card, then tap the box.

      Watch

      What makes a row public? Its Route table: The road signs for a row: which way each address goes.: the road signs. Tap the sign that leads to the street.

      Tap the route that makes this row public.

      0 of 1 found

      Try it

      Plan both rows in both wings. Public rows need 20 addresses each. Private rows need 200.

      Give each row of units its own block of addresses. Nothing may overlap.

      VPC (the mall's land)

      10.0.0.0/16

      65,536 addresses in this VPC.

      The brief

      • Public subnet (faces the street): 2, one per zone, each with at least 20 usable addresses.
      • Private subnet (the back rooms): 2, one per zone, each with at least 200 usable addresses.
      Address map: 10.0.0.0 to 10.0.0.255
      • Public · ap-southeast-5a 10.0.0.0/27
      Public subnet (faces the street) · ap-southeast-5a

      Needs at least 20 usable addresses.

      32 addresses, 27 usable (AWS keeps 5).
      Public subnet (faces the street) · ap-southeast-5b

      Needs at least 20 usable addresses.

      No subnet yet. Pick a size.

      Private subnet (the back rooms) · ap-southeast-5a

      Needs at least 200 usable addresses.

      No subnet yet. Pick a size.

      Private subnet (the back rooms) · ap-southeast-5b

      Needs at least 200 usable addresses.

      No subnet yet. Pick a size.

      Which 5 addresses does AWS keep in 10.0.0.0/27?
      • 10.0.0.0 network address
      • 10.0.0.1 the VPC router
      • 10.0.0.2 Amazon DNS (base + 2)
      • 10.0.0.3 kept for future use
      • 10.0.0.31 broadcast (a VPC has no broadcast)

      Predict

      A /24 subnet has 256 addresses. How many can your servers use?

      Check

      Good row design, or risky? Swipe right for good.

      Swipe right for good, left for needs work. Or use the buttons.

      1 / 4

      One public and one private row in each of two wings

      You did it!

      You can now plan public and private rows in every wing.

      Go deeper (optional)

      The AWS CLI makes a row with aws ec2 create-subnet. Here is the official example’s answer, cut short. Note 251 usable addresses in a /24.

      bash
      aws ec2 create-subnet --vpc-id vpc-081ec835f3EXAMPLE --cidr-block 10.0.0.0/24
      {
      "Subnet": {
      "AvailabilityZone": "us-west-2a",
      "AvailableIpAddressCount": 251,
      "CidrBlock": "10.0.0.0/24",
      "MapPublicIpOnLaunch": false,
      "State": "available",
      "SubnetId": "subnet-0e99b93155EXAMPLE",
      ...