Question: When I launch a server with a security group that allows all traffic into my private subnet, it displays a warning that it may be open to the world. 

If it is a private subnet, how can that be?

Answer: 
As documented [here](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html)

**PUBLIC SUBNET** If a subnet's traffic is routed to an internet gateway, the subnet is known as a public subnet. 
**PRIVATE SUBNET**If a subnet doesn't have a route to the internet gateway, the subnet is known as a private subnet.
The problem we are trying to solve is to make some resources "private", that is deny inbound traffic from outside your VPC, but still allow those private resouces to access the internet for e.g. updates.

There are a couple of ways to do this:

* You could *try* to use Network Access Control Lists (NACL) but these affect inbound- and outbound traffic the same way ("stateless"). Therefore, you cannot deny inbound traffic while allowing outbound traffic. Also, they seem to be rarely recommended anyhow (see second comment of [this SO post](https://stackoverflow.com/a/61181364/2135504)).
* You could use security groups associated with each resource. This [would work well](https://stackoverflow.com/a/61181364/2135504) but seems the less popular solution (maybe because it's easy to forget adding a security group to a resource?)
* At last, you could setup a separate subnet without a connection to the internet gateway but instead a connection to a [NAT gateway](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html). That NAT gateway is usually (always?!) placed in another subnet which has a connection to the internet gateway. You'd then call these two subnets private and public, respectively. In other words, the terms "private subnet" and "public subnet" are really just names for this specific setup (as the other posts here state) and do not describe an inherent feature of the subnet.