if we are using vpn and using inbound rule can we put app in public subnet only and dissassociate public ip

Yes, you can further enhance the security of your application by disassociating the public IP address from your resources deployed in the public subnet. Disassociating the public IP address means that your resources will no longer be directly accessible from the internet.

Instead, access to your resources would be mediated through your VPN connection and controlled by the inbound rules configured in your network security groups or firewall. This adds an additional layer of security by reducing the attack surface and limiting access to authorized users or networks.

However, it's important to ensure that your VPN connection is properly configured and secured to prevent unauthorized access to your network resources. Additionally, you should regularly review and update your security configurations to mitigate potential security risks