Yes, you're right. I already had the db server in private subnet, but I thought to have web server in public subnet. But since traffic will be handled by the ALB, it does not make sense to have the web server in public subnet accessible to outside world.