How to create a no-internet access (private) subnet?

Question

**Points of My Scenario:**
1. I tried to create 3 private subnets (subnets without an internet gateway) so that EC2 instances would be unable to access Internet
2. I used the procedure in AWS document https://docs.aws.amazon.com/cloudhsm/latest/userguide/create-subnets.html
3. Upon completion, I checked the route table for each subnet...
4. Alas! Each one had destination 0.0.0.0/0 associated with the default igw-: just like the other system-generated subnets.

**Question:** why is this happening and how can I create truly private subnets?

Accepted Answer

In your VPC is a default route table. The instructions on that page don't mention it but if you don't assign a specific route table to a subnet the default is used. In your case, the default route table has a route to the Internet Gateway.

To fix this, create a new route table in your VPC and assign it to the private subnets.

How to create a no-internet access (private) subnet?

Relevant content