The recent introduction of hourly charges for public IPv4 addresses on AWS has thrown many users into a cost-saving frenzy. While the initial panic subsides, a strategic shift towards private subnets emerges as a powerful weapon in the fight against rising costs. This article serves as your guide to migrating your resources to private subnets, unlocking significant savings and optimizing your AWS environment.

Why Private Subnets?

Public IPv4 addresses are like prime real estate in the digital world – expensive and limited. Private subnets, on the other hand, offer a spacious and cost-effective alternative. Resources within a private subnet have private IP addresses, shielded from the public internet by a NAT Gateway. This allows internal communication while minimizing the need for costly public IPs.

Benefits of Migration:

  • Reduced Cost: Slash your public IPv4 usage by relocating resources to private subnets, significantly impacting your AWS bill.
  • Enhanced Security: Private subnets create an additional layer of security, restricting access to resources from the public internet.
  • Improved Scalability: Private subnets allow for easier scaling of your infrastructure without worrying about public IP limitations.

Migration Roadmap:

Identify Resources: Analyze your current infrastructure and identify resources that can be migrated to a private subnet. These may include web servers, application servers, and databases that don’t require direct public access. You can also enable Public IP Insights, a new feature of Amazon VPC IP Address Manager that is available to you at no cost. Analyze the public IP used by each resources.

Design Subnet Architecture: Plan your private subnet architecture, considering factors like security groups, routing tables, and access control lists (ACLs).

For example, let’s say you have an internet facing web application with load balancer and auto-scaling setup. You might have servers (EC2 instances) in public subnet with IPv4 enabled. In that case communication happens via IPv4 over internet.

You need move your servers/database to private subnet as those are not directly access by end user. Consider following diagram for example.

aws private subnet architecture to avoid aws ipv4 charges
Source: AWS

Create Private Subnet: Use the AWS Management Console or CLI to create private subnets within same availability zone where your public subnet is.

Configure NAT Gateway: Set up a NAT Gateway in your public subnet to provide internet access for outbound traffic from your private resources.

AWS NAT gateway

Create route table: A route table specifies how packets are forwarded between the subnets within your VPC, the internet.

AWS Route table
  • Attach your private subnets to the route table by modifying explicit subnet asscoiation
  • Under Route section, edit routes and set Destination to and target of NAT Gateway which we created previously.
AWS Route table route creation

Create VPC endpoint for S3: You can access Amazon S3 from your VPC using gateway VPC endpoints. After you create the gateway endpoint, you can add it as a target in your route table for traffic destined from your VPC to Amazon S3. There is no additional charge for using gateway endpoints. Transferring data to S3 with NAT gateway may increase your cost. So recommended approach is to use S3 Gateway endpoint.

AWS VPC endpoints

Now, Launch your servers in private subnet and test your application.

Test and Monitor: Thoroughly test your migrated resources and monitor network traffic to ensure functionality and security.


Migrating to private subnets is a strategic move to optimize your AWS environment and save on public IPv4 charges. By understanding the benefits, following the roadmap, and implementing best practices, you can unlock significant cost savings and enhance the security and scalability of your infrastructure. Remember, the journey to cost-efficiency starts with informed decisions and strategic action. So, take the first step towards private subnets and watch your AWS bill shrink happily ever after.

Disclaimer: This guide provides a general overview of migrating to private subnets. Always consult the official AWS documentation and tailor your approach based on your specific infrastructure and needs.

Don’t know about new IPv4 Charges? Checkout AWS Public IPv4 Charges