AWS VPC identify private and public subnet

Question

I have a VPC in AWS account and there are 5 subnets associated with that VPC. Subnets are of 2 types - Public and private. How to identify which subnet is public and which is private ? Each subnet has CIDR 10.249.?.? range.

Basically when I launch an EMR in that subnet with lists of ec2SubnetIds , it says ***The subnet configuration was invalid: Provided subnet list contains both public and private subnet. Only one type of subnet is allowed.

How to recify this error.

you can check the subnets for NAT and IGW. IGW suggests public subnet, whereas NAT suggests private subnet. — Varun Chandak, Feb 18 '18 at 12:14
@VarunChandak I think you mean "check the default routes of the subnets", rather than "check the subnets". — jarmod, May 07 '20 at 19:45
Please consider accepting an answer if it solved your problem. — jarmod, Nov 10 '20 at 13:21

jarmod · Answer 1 · 2020-01-09T01:08:12.450

The question is how to identify public subnets vs. private subnets, and the answer lies in what it means in AWS for a subnet of a VPC to be 'public' vs. 'private'.

Public subnets have a default route to an Internet Gateway; private subnets do not.

So, to determine if a given subnet is public or private, you need to describe the route table that is associated with that subnet. That will tell you the routes and you can test for a 0.0.0.0/0 route with a gateway ID of igw-xxxxxxxxxxxxxxxxx (as opposed to local).

You can tell if a subnet is public in the AWS VPC Console by reviewing the subnet's route table, for example:

You can also do this as follows for a given subnet ID, using the awscli:

aws ec2 describe-route-tables \
    --filter Name=association.subnet-id,Values=subnet-0a123fc414ad5b999 \
    --query "RouteTables[].Routes[]"

The output will look like this:

[
    {
        "DestinationCidrBlock": "10.0.0.0/16",
        "GatewayId": "local",
        "Origin": "CreateRouteTable",
        "State": "active"
    },
    {
        "DestinationCidrBlock": "0.0.0.0/0",
        "GatewayId": "igw-0fca21fadaa22a1b2",
        "Origin": "CreateRoute",
        "State": "active"
    }
]

Here, you can see a destination route of 0.0.0.0/0 with a target that is an Internet Gateway (its GatewayId is igw-xxxxxxxxxxxxxxxxx). This confirms that you are looking at a public subnet.

how do you actually do this "test for a "0.0.0.0/0" route with a gateway ID of igw-xxxxxxxx (as opposed to "local")." part? — themiDdlest, Jan 08 '20 at 22:28

score 2 · Answer 2 · answered Feb 16 '18 at 16:48

The best solution is to specify only a single subnet, so that you don't incur cross-AZ data charges.

There's no definite way to identify public and private subnets without looking at their routing tables: a public subnet will route to an Internet Gateway, while a private subnet won't. If you're creating your clusters via some program then maybe that's a reasonable check, but I wouldn't go there.

The best alternative is to give the subnet a name when you create it: something like "Private B" for a private subnet in availability zone B (us-east-1b, us-west-1b, whatever). If you're launching your cluster via the console that name should be shown in the list of available subnets (I haven't manually launched an EMR cluster in years, so don't know for sure).

Alternatively, you can give your subnets arbitrary tags. This is probably most useful if you're accessing them programmatically.

And after identifying private subnet,Since EMR does not allow mix of private and public subnet, I deleted public subnet from list and kept only private subnet then it says a warning No Amazon S3 endpoint found in subnet-***. S3 endpoints are recommended for EMR to access data in S3. Whats the resolution of this. NatGateway is associated with subnet. — user1846749, Feb 18 '18 at 13:37

AWS VPC identify private and public subnet

2 Answers2