<p>There is a range of common scenarios when you want to use private subnets to be used in an auto scaling group:</p>

<ul>
<li>Your traffic <s>is terminated by</s> reaches your infrastructure on a  Elastic Load Balancers and your web server instances are behind the load balancer. This reduces the attack surface of the web servers.</li>
</ul>

<p>( I think I started to use "terminate" since seeing it being used for SSL/TLS termination, ie the server(s) that hold the secure certificates. But because you could also use a Network Load Balancer at the "edge" of your infrastructure, I see now its not appropriate to use in this context)</p>

<ul>
<li>Your auto scaled resources are actually not responding to outside traffic, for example if they are worker resources processing messages from an SQS queue.</li>
</ul>

<p>There was a similar mention of both "public and private subnets" all over my LinuxAcademy exam preparation, depending on your thinking processes it may be straightforward to just say: "autoscaling can use subnets", but then this may confuse other people.</p>

CC BY-SA 4.0
2019-12-16T01:27:30.180Z
I understand your second point. On your first point "Your traffic is terminated by Elastic Load Balancers and your web server instances are behind the load balancer. This reduces the attack surface of the web servers", can you rephrase that? I am not sure I understand why I would want ELB to terminate traffic to web server instances which are being manged by the load balancer. Isn't the purpose of web server to have traffic?
Daniel Viglione
CC BY-SA 4.0
2019-12-16T07:24:30.643Z
I have rewritten it, good point.
jdog
CC BY-SA 4.0
2019-12-15T08:47:30.477Z
2019-12-16T07:23:59.073Z
2019-12-16T07:23:59.073Z
jdog
<p>I watched a video series wherein the author used 3 private subnets for his Auto Scaling Group, and I also read the premium answer on this forum wherein the author says that you can use both public and private subnets in an Auto Scaling Group:</p>

<p><a href="https://acloud.guru/forums/aws-certified-solutions-architect-associate/discussion/-K_JalpbCBG_pUIbNc4k/vpc-private-subnet-and-autoscaling" rel="nofollow noreferrer">https://acloud.guru/forums/aws-certified-solutions-architect-associate/discussion/-K_JalpbCBG_pUIbNc4k/vpc-private-subnet-and-autoscaling</a></p>

<blockquote>
  <p>"When you create the "Auto Scaling Group" you will specify your VPC
  and as many of the related "Subnets" that you want to launch instances
  into - it does not matter if they are private or public it is entirely
  up to how you have designed your solution."</p>
</blockquote>

<p>So I tried it. I use three private subnets in my Auto Scaling Group and the website does not load from the public DNS or the public IP. I notice the IP of the instance belongs to one of the private subnets, 10.0.4.135 (the subnet is 10.0.4.0). Also, the issue is not with Security Groups, because that instance above has a security group allowing all outbound traffic and inbound traffic from 80, 443 and 22.</p>

<p>Now if I used 3 public subnets, then the site will load! So what's the difference? The private subnet uses a NAT Gateway and the public subnet uses an Internet Gateway. It makes sense that traffic CANNOT go to this private subnet since there is no internet gateway to it; that's the whole purpose of having a private subnet.</p>

<p>So then why does the premium member state that an Auto Scaling Group can use both public and private subnets?</p>

<amazon-web-services><amazon-ec2><autoscaling>
private subnets in an Auto Scaling Group on aws?
Daniel Viglione
# private subnets in an Auto Scaling Group on aws?

(Asked by: username_0 on 2019-12-15)

I watched a video series wherein the author used 3 private subnets for his Auto Scaling Group, and I also read the premium answer on this forum wherein the author says that you can use both public and private subnets in an Auto Scaling Group:

<https://acloud.guru/forums/aws-certified-solutions-architect-associate/discussion/-K_JalpbCBG_pUIbNc4k/vpc-private-subnet-and-autoscaling>

> "When you create the "Auto Scaling Group" you will specify your VPC
> and as many of the related "Subnets" that you want to launch instances
> into - it does not matter if they are private or public it is entirely
> up to how you have designed your solution."

So I tried it. I use three private subnets in my Auto Scaling Group and the website does not load from the public DNS or the public IP. I notice the IP of the instance belongs to one of the private subnets, 10.0.4.135 (the subnet is 10.0.4.0). Also, the issue is not with Security Groups, because that instance above has a security group allowing all outbound traffic and inbound traffic from 80, 443 and 22.

Now if I used 3 public subnets, then the site will load! So what's the difference? The private subnet uses a NAT Gateway and the public subnet uses an Internet Gateway. It makes sense that traffic CANNOT go to this private subnet since there is no internet gateway to it; that's the whole purpose of having a private subnet.

So then why does the premium member state that an Auto Scaling Group can use both public and private subnets?

**Tags:** amazon-web-services, amazon-ec2, autoscaling


---

## 1 answers

### Answer by username_1 on 2019-12-15. Score: 1 | Accepted answer

There is a range of common scenarios when you want to use private subnets to be used in an auto scaling group:

* Your traffic ~~is terminated by~~ reaches your infrastructure on a Elastic Load Balancers and your web server instances are behind the load balancer. This reduces the attack surface of the web servers.

( I think I started to use "terminate" since seeing it being used for SSL/TLS termination, ie the server(s) that hold the secure certificates. But because you could also use a Network Load Balancer at the "edge" of your infrastructure, I see now its not appropriate to use in this context)

* Your auto scaled resources are actually not responding to outside traffic, for example if they are worker resources processing messages from an SQS queue.

There was a similar mention of both "public and private subnets" all over my LinuxAcademy exam preparation, depending on your thinking processes it may be straightforward to just say: "autoscaling can use subnets", but then this may confuse other people.

> **Comments:**
> **username_0**: I understand your second point. On your first point "Your traffic is terminated by Elastic Load Balancers and your web server instances are behind the load balancer. This reduces the attack surface of the web servers", can you rephrase that? I am not sure I understand why I would want ELB to terminate traffic to web server instances which are being manged by the load balancer. Isn't the purpose of web server to have traffic?  
> **username_1**: I have rewritten it, good point.  

---

