Check if aws subnet is public - checks if internet gateway is attached to a route on a routetable of a subnet.

CheckSubnetisPublic.sh

#!/usr/bin/env python3

# Quick script to create a dict of subnetid -> isPublic (check if AWS VPC subnet is public or not)
import boto3

ec2 = boto3.client('ec2')

subnetDict = {}

apicall = ec2.describe_route_tables()

for routeTable in apicall['RouteTables']:
    associations = routeTable['Associations']
    routes = routeTable['Routes']

    for assoc in associations:
        subnetId = assoc.get('SubnetId', '')

    isPublic = False

    for route in routes:
        gatewayId = route.get('GatewayId', '')
        if gatewayId.startswith('igw-'):
            isPublic = True

    if subnetId:
        subnetDict[subnetId] = isPublic

print(subnetDict)

Thanks for posting this - it came in handy.

An issue I see is that multiple subnets can be associated with a RouteTable and your association loop assigns the last one in the collection to the subnetId var. The results in reporting only a single subnet for each route table. Maybe this is what you intended but if not, this adjustment reports all explicitly associated subnets:
` subnetDict = {}
apicall = ec2.describe_route_tables()

    for routeTable in apicall['RouteTables']:
        associations = routeTable['Associations']
        routes = routeTable['Routes']
        isPublic = False

        for route in routes:
            gid = route.get('GatewayId', '')
            if gid.startswith('igw-'):
                isPublic = True

        if(not isPublic):
            continue            

        for assoc in associations:
            subnetId = assoc.get('SubnetId', None)  # This checks for explicit associations, only
            if subnetId:
                subnetDict[subnetId] = isPublic

    if subnetDict:
        print(subnetDict)`