The default VPC we used so far had only public subnets. Now that we have public and private subnets, we can adapt our applications to take advantage of it. Our Hello World application and its three-tier architecture fits perfectly in that design.

For our application to be accessible on the internet, we will need to keep the ELB in the public subnets but the EC2 instances can be moved to the private zone. This won't be an issue as resources in the public zone can reach resources in the private zone.