What is the difference between a public and private subnet in a Amazon VPC?
Solution 1:
The main difference is the route for 0.0.0.0/0 in the associated route table.
A private subnet sets that route to a NAT instance. Private subnet instances only need a private ip and internet traffic is routed through the NAT in the public subnet. You could also have no route to 0.0.0.0/0 to make it a truly private subnet with no internet access in or out.
A public subnet routes 0.0.0.0/0 through an Internet Gateway (igw). Instances in a public subnet require public IPs to talk to the internet.
The warning appears even for private subnets, but the instance is only accessible inside your vpc.
Solution 2:
As documented here
PUBLIC SUBNET If a subnet's traffic is routed to an internet gateway, the subnet is known as a public subnet. PRIVATE SUBNETIf a subnet doesn't have a route to the internet gateway, the subnet is known as a private subnet.
Solution 3:
The Topic of this question is different from the actual problem which is described above. This topic is also important and highly searched over the Internet, and just because of this, other websites have much higher views of the same topic as it is not well defined here, if both Public and Private Subnets can go To the Internet to download updates and packages then what is the difference between them? Both should be Public then, but let me clear this and add my answer from AWS point of view, as well as a conceptual, practical point of view.
Answer of the Topic:
Public and Private Subnets are the name of the concept, not actually a separate entity.
Answer of the Actual Problem which is being asked
The warning is Correct technically, I am assuming you are talking about Inbound Traffic, not Outbound, because if you wanted to download software, packages, updates so you have to add every single IP in the Outbound which is practically not good and time consuming., so, the warning is about other networks and Private classes
For example: if you are adding a rule in Private Subnet security group like Inbound 0.0.0.0/0 so it doesn't mean that it is available for Public and someone can send a request to that Instance/service/machine, what actually it means that other Private Subnets or Private networks can communicate with your instance or services, like 192.168.x.x, 172.16.x.x, 10.0.0.0 Private classes, which is only possible if your routes are allowed to do that. Other than this, you can ignore that warning and not worry about it. Here you have to understand the difference between From the Internet and To the Internet, so as per Security Group rules and help info, it will show you that warning which can be misunderstood by anyone.
The Confusion
When you create a Subnet in AWS VPC, there is an option Auto-assign Public IPv4 This is the main problem which makes confusion to the people if it is set to Yes, then your Subnet is Public, no matter what name or key-value you tagged to the Subnet, which means, at the time of Subnet creation, if you use a name like Private Subnet-A so it doesn't mean its Private Subnet, it depends on your use case and configurations (Auto-assign Public IP option).
Difference between Public and Private Subnet:
Instances in Public Subnet can be accessible From the Internet, which means traffic From the Internet can hit a machine/Instance/Service in Public Subnet. You normally keep things like Load Balancers, Web Servers in Public Subnet. So when you create them, you add name Public in front of them to keep them separate from others and, it doesn't matter you enabled Auto-assign Public IPv4, but every time you choose the Public Subnet that you marked Public, you have to check or enable Auto-assign Public IPv4 option when you launch an instance of EC2 or RDS/Service. But it's better if you enable Auto-assign Public IPv4 at Subnet level to make it properly Public because this is the reason you are making difference and using Public-Private concept, so whenever you launch any service/Instance/machine in Public Subnet, it will be able to accessible From the Internet and To the Internet, means, You can hit the service/Instance over the Internet and can download updates and packages in the service/Instance as well. You can check who is going To the Internet by simply typing the command curl wgetIP.com, you will see your Instance/machine Public IP in results.
"Because, when you launch an instance into a Subnet that has this attribute enabled, a Public IP address is assigned to the primary network interface (eth0) that's created for the instance. A Public IP address is mapped to the primary Private IP address through network address translation (NAT).".....said, AWS.
Instances in Private Subnet can not be accessible From the Internet. E.g. you can put Database Server, Redis Server or these kinds of other services in a Private Subnet and no one can access it From the Internet. It would be accessible only via Instances/machines/Services in Public Subnet (Web server, ELB, etc). Because it doesn't have Public IP enabled option and also we marked it as Private for the specific use as explain, for security and unwanted access over the Internet. This is good for architecture level security to avoid loopholes. To access this Private Subnet services/Instances, you have to add allow rule in Security group and add proper routes in the route table.
Now the question is,
Can Private Subnet go To the Internet?
So, answer is by default no,
If you wanted to access To the Internet through a Private Subnet or a Subnet having no Public IP or a Subnet having disabled Auto-assign Public IPv4, you need to create NAT instance or a NAT-gateway, and that NAT-gateway must have Public IP so, your service/Instance with Private IP will go to the Internet and can download updates,software and packages.
Private IP will route traffic to NAT-gateway and NAT-gateway will route to Internet Gateway. Then your communication from Private Subnets to Internet can start, you can check your IP by simply running command curl wgetIP.com, it will give you NAT-gateway Public IP, because NAT-gateway will go to the Internet for you and Internet gateway is a path of outside communication to the world and its a term in networking as well to pass the traffic from inbound to outbound. You can simply understand its main gate of the building for the exit.
Conclusion The instances in the public subnet can send outbound traffic directly to the Internet, whereas the instances in the private subnet can't. Instead, the instances in the private subnet can access the Internet by using a network address translation (NAT) gateway that resides in the public subnet. The database servers can connect to the Internet for software updates using the NAT gateway, but the Internet cannot establish connections to the database servers.".....said, AWS
Links:
Internet Access: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html
VPC & Subnets Basics: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html
VPC with Public and Private Subnets (NAT): https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario2.html