public vs. private subnet
expressioncloud
The basic VPC split: public subnets route to the internet gateway and can be reached; private subnets reach out through NAT and cannot.
Load balancers in public, workloads in private: the pattern behind most cloud reference architectures.