Subnets and route tables

A VPC is one big address block until you carve it into subnets and decide where each subnet's traffic goes. Subnets pin addresses to a single AZ, route tables decide the path out, and the difference between a public and a private subnet is nothing more than which route table it follows.