Public (route to Internet Gateway, instances get public IPs), Private with NAT (can reach internet via NAT Gateway but not reachable from it), and Isolated (no internet at all, internal only). Use public for ALBs, private for app servers, isolated for databases.