Question: When I launch a server with a security group that allows all traffic into my private subnet, it displays a warning that it may be open to the world. 

If it is a private subnet, how can that be?

Answer: 
As documented [here](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html)

**PUBLIC SUBNET** If a subnet's traffic is routed to an internet gateway, the subnet is known as a public subnet. 
**PRIVATE SUBNET**If a subnet doesn't have a route to the internet gateway, the subnet is known as a private subnet.
The distinction between "public" and "private" subnets in AWS VPC is determined only by whether the subnet has an Internet Gateway (IGW) attached to it. From [the AWS docs](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html):

> 
> If a subnet is associated with a route table that has a route to an internet gateway, it's known as a public subnet. If a subnet is associated with a route table that does not have a route to an internet gateway, it's known as a private subnet.
> 
> 
> 

The IGW allows network traffic from the internet to reach endpoints inside the subnet.

To answer your second question:

> 
> When I launch a server with a security group that allows all traffic into my private subnet, it displays a warning that it may be open to the world. If it is a private subnet, how can that be?
> 
> 
> 

It appears AWS does not check whether your chosen subnet has a route table with an IGW or not, when displaying that warning. It's a blanket warning they always show when you set up an instance with a security group allowlisting all inbound traffic. They use "may be" (as opposed to "will be") in there to cover their butts, but the warning is only relevant if you are on a public subnet.