private subnets in an Auto Scaling Group on aws?

Question

I watched a video series wherein the author used 3 private subnets for his Auto Scaling Group, and I also read the premium answer on this forum wherein the author says that you can use both public and private subnets in an Auto Scaling Group:

https://acloud.guru/forums/aws-certified-solutions-architect-associate/discussion/-K_JalpbCBG_pUIbNc4k/vpc-private-subnet-and-autoscaling

"When you create the "Auto Scaling Group" you will specify your VPC and as many of the related "Subnets" that you want to launch instances into - it does not matter if they are private or public it is entirely up to how you have designed your solution."

So I tried it. I use three private subnets in my Auto Scaling Group and the website does not load from the public DNS or the public IP. I notice the IP of the instance belongs to one of the private subnets, 10.0.4.135 (the subnet is 10.0.4.0). Also, the issue is not with Security Groups, because that instance above has a security group allowing all outbound traffic and inbound traffic from 80, 443 and 22.

Now if I used 3 public subnets, then the site will load! So what's the difference? The private subnet uses a NAT Gateway and the public subnet uses an Internet Gateway. It makes sense that traffic CANNOT go to this private subnet since there is no internet gateway to it; that's the whole purpose of having a private subnet.

So then why does the premium member state that an Auto Scaling Group can use both public and private subnets?

Answer 1

There is a range of common scenarios when you want to use private subnets to be used in an auto scaling group:

• Your traffic is terminated by reaches your infrastructure on a Elastic Load Balancers and your web server instances are behind the load balancer. This reduces the attack surface of the web servers.

( I think I started to use "terminate" since seeing it being used for SSL/TLS termination, ie the server(s) that hold the secure certificates. But because you could also use a Network Load Balancer at the "edge" of your infrastructure, I see now its not appropriate to use in this context)

• Your auto scaled resources are actually not responding to outside traffic, for example if they are worker resources processing messages from an SQS queue.

There was a similar mention of both "public and private subnets" all over my LinuxAcademy exam preparation, depending on your thinking processes it may be straightforward to just say: "autoscaling can use subnets", but then this may confuse other people.