Study guide

Technical reference and lesson notes

AWS Private Subnet Internet Access with a NAT Gateway

Purpose of This Lesson

This lesson demonstrates how to enable outbound internet access for an EC2 instance in a private subnet without placing the instance directly in a public subnet. The solution uses a NAT Gateway deployed in a public subnet, an Elastic IP address, and a default route in the private subnet’s route table.

The lab also reinforces the cleanup steps required to avoid unnecessary charges from the NAT Gateway and unused Elastic IP address.

Key Concepts

Private subnet: A subnet whose route table does not provide a direct route to an internet gateway for internet-bound traffic.
Public subnet: A subnet with a route to an internet gateway. The NAT Gateway must be deployed here.
NAT Gateway: Provides outbound internet connectivity for resources in private subnets while those resources remain private from unsolicited inbound internet connections.
Elastic IP address: A public IPv4 address allocated to and associated with the NAT Gateway.
Private route table: The route table associated with the private subnet. It must direct internet-bound traffic to the NAT Gateway.
Default route: The route 0.0.0.0/0, which represents destinations outside the VPC CIDR range.
Bastion host: A host in a public subnet used in the lab to connect to the private EC2 instance. The bastion host is separate from the NAT Gateway’s routing function.

NAT Gateway Configuration and Traffic Flow

The existing architecture contains:

An EC2 instance in a private subnet.
A bastion host in a public subnet for administrative access to the private instance.
A private route table containing the local VPC route but no path for internet-bound traffic.

To enable outbound internet access:

Create a NAT Gateway in a public subnet in the same VPC.
Allocate an Elastic IP address for the NAT Gateway.
Update the route table associated with the private subnet.
Add the route 0.0.0.0/0 with the NAT Gateway as the target.
Wait until the NAT Gateway reaches the Available state.
Test outbound connectivity from the private EC2 instance.

The existing local route continues to handle traffic within the VPC CIDR block. The new default route handles destinations outside that CIDR block, such as an external internet address.

The resulting path is conceptually:

Private EC2 instance
        |
        | 0.0.0.0/0
        v
Private route table
        |
        v
NAT Gateway in public subnet
        |
        v
Internet Gateway / Internet

The private instance does not need to be moved to a public subnet. The NAT Gateway performs the required network address translation for outbound traffic.

Exam- or Assessment-Relevant Takeaways

For AWS Certified CloudOps Engineer Associate scenario questions, recognize these decisive clues:

A resource in a private subnet needs outbound internet access: consider a NAT Gateway.
The NAT Gateway itself must be placed in a public subnet.
The NAT Gateway requires an Elastic IP address.
The route must be added to the private subnet’s route table, not the public route table.
The route destination for general internet-bound traffic is 0.0.0.0/0.
The route target is the NAT Gateway.
A NAT Gateway can take several minutes to become usable, so an immediate connectivity test may fail while it is still provisioning.
NAT Gateway deletion and Elastic IP release are separate cleanup steps. The Elastic IP cannot be released while it remains associated with the NAT Gateway.

Tool / Feature Decision Guide

Requirement	Appropriate configuration	Reason
Private EC2 instance needs outbound internet access	NAT Gateway in a public subnet	Provides an egress path while the instance remains in the private subnet
Choosing where to deploy the NAT Gateway	Public subnet in the same VPC	The NAT Gateway needs public network connectivity
Choosing the route destination	`0.0.0.0/0`	Matches traffic destined outside the VPC CIDR range
Choosing where to add the route	Private subnet route table	Private resources must send internet-bound traffic to the NAT Gateway
Assigning a public address to the NAT Gateway	Allocate an Elastic IP	The NAT Gateway uses the Elastic IP for internet access
Finishing a temporary lab	Delete the NAT Gateway, then release its Elastic IP after deletion completes	Prevents unnecessary resource and address charges

Common Traps / Misconceptions

Putting the NAT Gateway in the private subnet: The NAT Gateway belongs in a public subnet, even though it serves private-subnet resources.
Updating only the public route table: The route decision for the private EC2 instance is made by the private subnet’s associated route table.
Using the VPC CIDR as the internet route: The VPC CIDR represents local VPC traffic. Use 0.0.0.0/0 for all other destinations.
Expecting immediate availability: A newly created NAT Gateway may need several minutes to reach the Available state.
Forgetting the Elastic IP: Creating the NAT Gateway requires allocating an Elastic IP address.
Trying to release the Elastic IP too early: The address remains associated while the NAT Gateway exists or is still completing deletion. Wait for deletion to finish, refresh, and then release the address.
Treating the bastion host as the NAT solution: The bastion host provides administrative access to the private instance; the NAT Gateway provides the configured outbound internet path.
Leaving the NAT Gateway after the lab: NAT Gateways incur charges, so temporary environments should be cleaned up promptly.

Real-World Engineer / Analyst Notes

Verify the NAT Gateway is in the intended VPC and public subnet before troubleshooting the route table.
Confirm that the route table being edited is actually associated with the private subnet containing the workload.
Distinguish the local VPC route from the default internet-bound route. Both are needed for the expected behavior: local traffic stays within the VPC, while external traffic uses the NAT Gateway.
When testing, allow time for the NAT Gateway to transition to Available before concluding that the configuration is broken.
Include NAT Gateway deletion and Elastic IP cleanup in the teardown procedure for temporary environments.
NAT Gateway usage has a cost implication, so production designs and lab environments should account for its lifecycle and placement.

Quick Reference Summary

NAT Gateway location:       Public subnet
VPC relationship:           Same VPC as the private workload
Public address:             Elastic IP
Route table to modify:      Private subnet route table
Internet route:             0.0.0.0/0
Route target:               NAT Gateway
Readiness state:            Available
Cleanup order:              Delete NAT Gateway -> wait -> release Elastic IP

The essential distinction is: the NAT Gateway is in the public subnet, but the default route to it is in the private route table.

Flashcards

Q: An EC2 instance in a private subnet needs outbound internet access while remaining private. Which AWS feature should be added?

A: Deploy a NAT Gateway in a public subnet and route the private subnet’s internet-bound traffic to it.

Q: Where must a NAT Gateway be deployed?

A: It must be deployed in a public subnet, typically in the same VPC as the private resources it serves.

Q: Which route table must be modified when enabling internet access for a private-subnet instance through a NAT Gateway?

A: Modify the route table associated with the private subnet, because that is where the instance makes its routing decision.

Q: What destination represents all traffic outside the VPC CIDR block?

A: 0.0.0.0/0, the default route.

Q: What target should the private route table use for its 0.0.0.0/0 route in this design?

A: The NAT Gateway.

Q: Why is an Elastic IP allocated when creating the NAT Gateway in this lab?

A: The NAT Gateway uses the Elastic IP as its public IPv4 address for outbound internet connectivity.

Q: Compare the roles of the bastion host and the NAT Gateway in this architecture.

A: The bastion host provides an administrative connection to the private instance. The NAT Gateway provides the private instance’s outbound internet path.

Q: A NAT Gateway has been created, but an internet connectivity test fails immediately. What should you check first?

A: Check whether the NAT Gateway has reached the Available state. Provisioning can take several minutes.

Q: What route remains responsible for traffic within the VPC CIDR range?

A: The local VPC route handles traffic within the VPC CIDR range; the 0.0.0.0/0 route handles other destinations.

Q: Why is placing the NAT Gateway in a private subnet a configuration error?

A: The NAT Gateway needs public-subnet connectivity to provide an internet egress path for private resources.

Q: What is the correct cleanup sequence for the NAT Gateway and its Elastic IP?

A: Delete the NAT Gateway, wait until deletion completes, refresh the console, and then release the Elastic IP.

Q: Why might AWS prevent immediate release of the Elastic IP after starting NAT Gateway deletion?

A: The Elastic IP is still associated with the NAT Gateway until the gateway is fully deleted.

Practice Questions

Question 1

An EC2 instance is in a private subnet. A NAT Gateway has been created, but the instance still cannot reach an external address. The NAT Gateway is in a public subnet and is now Available. Which change is most directly required?

A. Add a route from the public route table to the private EC2 instance
B. Add 0.0.0.0/0 targeting the NAT Gateway to the private subnet’s route table
C. Move the EC2 instance into the NAT Gateway’s subnet
D. Replace the local VPC route with the NAT Gateway route

Correct answer: B

Explanation: The private subnet’s route table must send destinations outside the VPC CIDR block to the NAT Gateway. The local route should remain in place.

Question 2

A learner is creating a NAT Gateway and must choose its subnet. Which selection is correct?

A. Any subnet in any VPC
B. The private subnet containing the EC2 instance
C. A public subnet in the same VPC
D. The subnet associated with the bastion host’s security group

Correct answer: C

Explanation: The NAT Gateway must be placed in a public subnet in the same VPC as the private workload. The bastion host’s security group does not determine NAT Gateway placement.

Question 3

A lab administrator deletes the NAT Gateway and immediately attempts to release its Elastic IP. AWS reports that the address is still associated. What should the administrator do?

A. Allocate a second Elastic IP and release both addresses
B. Delete the private route table
C. Wait for NAT Gateway deletion to finish, refresh, and release the Elastic IP afterward
D. Move the Elastic IP to the bastion host first

Correct answer: C

Explanation: The Elastic IP remains associated until the NAT Gateway is fully deleted. After deletion completes, refresh the console and release the address.

Question 4

Which statement best describes the routing arrangement in the lab?

A. The public route table sends private-subnet traffic directly to the internet
B. The private route table uses the local route for VPC traffic and the NAT Gateway for 0.0.0.0/0 traffic
C. The bastion host automatically forwards all traffic without route changes
D. The NAT Gateway replaces the VPC’s local route

Correct answer: B

Explanation: The local route handles traffic inside the VPC CIDR, while the default route sends other traffic to the NAT Gateway.

WordPress Metadata

Suggested Slug:
aws-private-subnet-nat-gateway

Meta Description:
Learn how to provide outbound internet access to an EC2 instance in a private subnet by deploying a NAT Gateway in a public subnet and updating the private route table.

Tags:
AWS, Amazon VPC, NAT Gateway, Private Subnet, Public Subnet, Route Tables, Elastic IP, EC2, AWS Certified CloudOps Engineer