Private subnet by default, public by exception

Most of a serverless backend never needs to be reachable from the internet. Keep it in the private subnet, expose only the resolver, and let Cognito carry the trust you didn't have to build yourself.

Most of the backend is Lambda sitting in a private subnet — no route to the internet, nothing to scan, nothing to probe. It doesn't need to be public, because nothing outside the VPC ever calls it directly.

The only piece that has to be reachable is the API surface, and that's deliberately narrow — AppSync or API Gateway, sitting in the public subnet, forwarding into the private compute behind it. One door, not a wall of open ports.

The part nobody reads the source of

Authentication rides on Cognito, which means the team is trusting a piece of infrastructure none of us has read the code for. That's a reasonable trade — AWS's job is to get that primitive right so ours doesn't have to be — but it's worth naming, since "reasonable trade" is not the same as "no risk."

Public subnet, private subnet, Cognito in between — the safety is mostly architectural, not code any of us wrote ourselves.