How aws fetch public ip in the private vpc

Hello,

The assignment of public IP addresses to EC2 instances in AWS is controlled at the subnet level, not at the VPC level. If you've enabled auto-assign public IPv4 address at the subnet level or allow instances to have public IP addresses if configured during instance launch, the EC2 instances will be assigned with a Public IPv4 address.

Note that since you don't need the public IPs, and because AWS charges a fee for each public IPv4 address, and since there is the risk that an IGW and routes would later be added and the instances with the public IPs might be exposed to the public internet by accident, it's best to remove the public IPs.

Removing an automatically assigned public IP wasn't previously possible without terminating and recreating the instance (or detaching and recreating a secondary network interface), but it recently became possible to do simply by modifying the network interface (ENI, elastic network interface) options. The procedure is explained here: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#managing-network-interface-ip-addresses

Technically, the way all public IPv4 addresses are implemented for EC2 instances is that when traffic arrives to the public IPv4 address, AWS translates the destination IP of the packet to the primary private IPv4 address of the network interface. Return traffic is treated the same way in reverse. That's why also in your current situation, your VPC flow logs would likely show port scans and probes trying to reach your instances with public IPs, despite there being no IGW and even if security groups or network ACLs are dropping the incoming packets. That's because every packet that is received at the public IP first gets its destination IP translated to the private IP of the corresponding ENI and only then evaluated against security group rules, network ACLs, and so on.

The solution is to ensure your subnets are not configured to assign public IPs, as Oleksii Bebych advised earlier. For your existing instances not having public IPv4 addresses but not needing them, I advise you follow the instructions in the documentation article above to remove the public IPs. It will also save you a few dollars per month per public IPv4 address.