<p><a href="https://docs.aws.amazon.com/eks/latest/userguide/creating-a-vpc.html" rel="nofollow noreferrer">This</a> article from AWS states that recommended production setup for EKS is a mix of private and public subnets. Unfortunately it does not explain the 'why'.
What is wrong with the option 'only public subnets' assuming it has a properly configured security groups? It seems much simpler and cheaper (since we do not need NAT).</p>

<p>This <a href="https://stackoverflow.com/questions/22188444/why-do-we-need-private-subnet-in-vpc">SO</a> seems to actually answer my question:</p>
<p>In particular the question in one of the comments:</p>
<blockquote>
<p>What is the advantage of a server on a private subnet with a NAT instance and a a server public subnet with a strict security policy?</p>
</blockquote>
<p>and the answer:</p>
<blockquote>
<p>it's not really about an advantage. It's about the way networking works, in VPC. All of the instances on a given subnet have to use the same default gateway, which will either be the &quot;Internet gateway&quot; virtual object, which will not do NAT, or it will be a NAT instance, which will not &quot;not do&quot; NAT. Unless all your machines have public IPs, or none of them do, you're going to want both types of subnets. If everything is an Internet-facing web server, sure, you might need only a public subnet, and with correct security configuration, there's no disadvantage.</p>
</blockquote>
