Route Table
The set of rules deciding where traffic leaving a subnet is sent, and the thing that actually makes a subnet public or private.
A subnet is "public" not because of a flag but because its route table has a route to an internet gateway. "Private" means it does not — typically routing internet-bound traffic to a NAT gateway instead, or nowhere at all.
Routes are matched most-specific-first, so a /32 route overrides a /16, which is how traffic to
one destination is diverted through an appliance while everything else takes the default path.
The entries that matter in a typical design: the local VPC route (implicit, cannot be removed), a default route to an internet or NAT gateway, routes to peered VPCs or a transit gateway, and routes to on-premises ranges via a VPN or dedicated connection.
The common misconfiguration is a subnet that was intended to be private sharing a route table with a public one — which silently exposes it. Route tables should be per tier, not shared by accident.