Hacker News Reader

Comment by scubbo | Hacker News Reader

Something that's missing from this (otherwise great!) guide, that has puzzled me for a while - what's the point? What does this configuration actually gain you/AWS? My best guess is that private subnets are for DDOS protection, but that seems like something that would be better handled by throttling. Given the amount of complaints I've heard about how difficult VPC/Subnet setup is, why bother with it at all? Staving off IP address exhaustion?

Or, to ask it another way - what would be the downside of all your resources being in 1 single-Subnet VPC, spread evenly across AZs?

View on HN

Typically, compliance requirements will drive you to implement private subnets.

Auditors will want to know which isolation mechanisms you have put in place, and private subnets should be part of your isolation strategies.

Other use-cases:

- Legacy (or third-party) apps whose security model assumes they are behind some sort of private firewall.

- Hybrid deployment where you need to bridge on-premises (or other clouds) address space(s) with your VPC.

> Or, to ask it another way - what would be the downside of all your resources being in 1 single-Subnet VPC, spread evenly across AZs?

Note that a subnet cannot spread across AZs. So, even if you only need/want public subnets, you will want to deploy at least 1 public subnet per AZ.

Thanks! That's certainly helpful!

Not sure I'm qualified to answer all of your questions on this but, from a networking perspective..

Private subnets will allow you to reduce your exposure to the Internet, also can reduce costs with something like a NAT gateway. It's useful for things that don't need to be public facing. Generally things on the private subnet can go outbound directly but not have anything come direct into that subnet, you'd need a solution that interfaces with the public side to facilitate that, or manually create a public IP association per instance.

You generally don't want one big subnet in general, it's a broadcast domain and it can be quite chatty when you get a lot of devices on it. Alongside that if you're doing multi-AZ and spanning layer-2 you end up with a lot of additional complexity to get that network to span and be highly available over multiple AZ's, while another subnet can be mostly independent. I know of some weird edge cases where you'd have to span layer-2, but if you're doing anything cloud-native you should be able to build around it.

Just as an fyi, inside Amazon's virtual network topology, there is no such thing as layer 2, and thus, no broadcast topology. Normally you'd be 100% correct in seeking to limit that bandwidth, but in Amazon everything works just a little differently.

Ah yes are right. I was thinking specifically networking, not AWS.

Thanks! I had to look up "broadcast domain" to understand the last paragraph, but that helped illuminate some things. Thank you!

That's good feedback - thank you.

Reply on news.ycombinator.com