AWS Private Subnets and NAT Gateways

Purpose of This Lesson

This lesson explains how to distinguish public and private subnets in an Amazon VPC, how instances in private subnets can reach the internet through NAT gateways, and how to provide administrative access and availability across Availability Zones. The key assessment skill is recognizing which route, address, and gateway components are required for each connectivity scenario.

Key Concepts

• Public subnet: A subnet whose associated route table includes a route to an Internet Gateway (IGW). Instances generally also need an automatically assigned public IPv4 or IPv6 address to communicate directly with the internet.
• Private subnet: A subnet that does not provide a direct route to an Internet Gateway and whose instances use private IP addresses only.
• Internet Gateway: Attached to the VPC and used by public-subnet routing for internet connectivity.
• NAT Gateway: Deployed in a public subnet to provide outbound internet access for resources in private subnets. It performs network address translation so external services see the NAT gateway’s Elastic IP address.
• Elastic IP: The public address attached to the NAT gateway and used as the source address visible to internet services.
• Bastion host: An instance in a public subnet used as an administrative jump point to reach instances in private subnets.
• Key pair and SSH authentication: The private key authenticates an SSH connection. Access to a private-subnet instance still requires the key or forwarded key-agent information even when connecting through a bastion host.

Subnet Routing and Administrative Access

A subnet is considered public when its route table has a default route, 0.0.0.0/0, to an Internet Gateway. The default route means traffic that does not match a more specific route is sent to the IGW. For an EC2 instance to use direct public connectivity, the instance also needs a public address, commonly provided through the subnet’s auto-assign public IPv4 or IPv6 setting.

A private subnet does not assign public addresses and does not route directly to an Internet Gateway. Instances retain private IP addresses, which prevents a computer on the internet from connecting directly to them.

Administrative access can use a public-subnet instance as a bastion host:

1. Connect from the administrator’s computer to the bastion host using the appropriate key pair.
2. From the bastion host, establish an SSH connection to the private-subnet instance.
3. Supply authentication for the second connection either by using a private key available on the bastion host or by using SSH agent forwarding.

Agent forwarding passes key-agent information through the initial SSH connection, allowing the second SSH connection to authenticate without necessarily placing another copy of the private key on the bastion host. The important operational concern is that the second connection still requires valid authentication.

NAT Gateway Deployment and Traffic Flow

Instances in a private subnet cannot access the internet directly because they have neither public addresses nor a direct route to an Internet Gateway. A NAT gateway provides outbound access through the following arrangement:

1. Deploy the NAT gateway in a public subnet.
2. Attach an Elastic IP to the NAT gateway.
3. Add a route in the private subnet’s route table that sends internet-bound traffic to the NAT gateway.
4. Ensure the public subnet hosting the NAT gateway has the required route to the Internet Gateway.

When a private instance connects to an internet service, the NAT gateway translates the source address. The external service sees the NAT gateway’s Elastic IP rather than the private IP of the originating instance. Multiple private instances can therefore appear to use the same public source address from the perspective of the external service.

The NAT gateway supports outbound access initiated from the private side in the scenario described here. It does not make the private instance directly reachable from the public internet merely because the instance can initiate outbound connections.

Multi-AZ NAT Gateway Design

A NAT gateway is highly available within its own Availability Zone, but that availability does not automatically provide resilience across Availability Zones. If multiple private-subnet instances in different Availability Zones depend on one NAT gateway and that gateway becomes unavailable, internet access for the dependent instances is affected.

A resilient design places a NAT gateway in each relevant Availability Zone. Each Availability Zone’s private-subnet route table points to the NAT gateway in that same Availability Zone. This provides zone-local redundancy: a failure affecting one Availability Zone does not remove the internet egress path for private instances in the other Availability Zones.

The routing pattern is therefore an important part of the design. Merely creating multiple NAT gateways is insufficient if private-subnet route tables do not point to the intended gateway for their Availability Zone.

Exam- or Assessment-Relevant Takeaways

• To identify a public subnet, look for a route to an Internet Gateway; for direct instance internet access, also check whether public IP assignment is enabled.
• A private-subnet instance cannot be reached directly from an internet-based computer using only its private IP address.
• A bastion host provides a jump point for administration, but SSH authentication is still required for both stages of the connection.
• A NAT gateway belongs in a public subnet and requires an Elastic IP.
• The private subnet’s route table—not the instance alone—must direct internet-bound traffic to the NAT gateway.
• Internet services see the NAT gateway’s Elastic IP after translation, not the private IP of the originating instance.
• NAT gateway high availability is limited to the Availability Zone containing that gateway; multi-AZ designs should use separate NAT gateways and corresponding route tables or routes.

Tool / Feature Decision Guide

Requirement	Appropriate design	Decisive reason
Direct internet connectivity for an EC2 instance	Public subnet, route to an Internet Gateway, and a public address	The instance must have both public routing and a public address for direct public connectivity.
Keep an instance without a public address but allow outbound internet access	Private subnet with a route to a NAT gateway	The NAT gateway translates private-source traffic for outbound access.
Reach a private instance for administration	Public bastion host plus SSH key authentication or agent forwarding	The private instance is not directly reachable from the internet.
Avoid a single NAT gateway becoming a cross-AZ dependency	Deploy a NAT gateway in each relevant Availability Zone and route each private subnet to the appropriate gateway	NAT gateway availability is within an Availability Zone, not automatically across all zones.
Make an internet service see a stable public source address	Use the NAT gateway’s attached Elastic IP	NAT translation presents that Elastic IP to the external service.

Common Traps / Misconceptions

• A subnet is public simply because an instance has a public IP: Public-subnet routing requires a route to an Internet Gateway; address assignment alone does not create the route.
• A private IP can be used for direct internet access: Private-subnet instances need a NAT gateway path for outbound internet access in this design.
• A NAT gateway belongs in a private subnet: The NAT gateway must be deployed in a public subnet and have an Elastic IP.
• A NAT gateway makes private instances publicly reachable: The described pattern provides outbound access; it does not turn the private instances into directly reachable public hosts.
• One NAT gateway is automatically highly available for the whole VPC: Its high availability is within its Availability Zone. A single gateway can remain a failure dependency for other zones.
• A bastion host removes the need for the private instance’s key: The second SSH hop still needs authentication, provided by a key on the host or agent forwarding.
• Multiple NAT gateways automatically provide redundancy: Private route tables must actually point to the appropriate gateways.

Real-World Engineer / Analyst Notes

• When troubleshooting private-instance internet access, inspect the complete path: private subnet route table, NAT gateway placement, NAT gateway Elastic IP, public subnet route to the Internet Gateway, and the instance’s originating subnet.
• When troubleshooting SSH through a bastion host, separate the two connections conceptually. Confirm access to the bastion first, then confirm that the bastion can reach the private instance and has appropriate authentication material.
• Record which private route table serves each Availability Zone. A route pointing to a NAT gateway in another zone may create a cross-zone dependency rather than the intended zone-local design.
• For scenario questions, identify whether the requirement is direct public access, outbound-only internet access, or administrative access to a private host. Those requirements lead to different components.
• Treat private subnet placement as an addressability and routing decision, not merely a naming convention. The route table and assigned addresses determine the effective connectivity.

Quick Reference Summary

• Public subnet: Route to IGW; instances requiring direct public connectivity also need public IP address assignment.
• Private subnet: No direct IGW route and private IP addressing only.
• Bastion access: Connect to a public host, then SSH to the private host using a private key or agent forwarding.
• NAT gateway requirements: Public subnet, Elastic IP, and a private route-table route to the gateway.
• NAT source translation: External services see the NAT gateway’s Elastic IP.
• Availability: NAT gateway resilience is within one Availability Zone; use one per relevant zone with matching private routes for multi-AZ resilience.

Flashcards

Q: What two networking characteristics identify a public subnet in this lesson?
A: Its route table has a route to an Internet Gateway, typically using 0.0.0.0/0, and instances needing direct public connectivity must have public address assignment.

Q: An EC2 instance has only a private IP and its subnet has no IGW route. What design provides outbound internet access?
A: Place a NAT gateway in a public subnet with an Elastic IP, then route internet-bound traffic from the private subnet’s route table to that NAT gateway.

Q: Where must a NAT gateway be deployed, and why?
A: It must be deployed in a public subnet so it can use the VPC’s Internet Gateway path for external connectivity.

Q: What public source address does an internet service see when a private instance connects through a NAT gateway?
A: It sees the Elastic IP attached to the NAT gateway, because the gateway performs network address translation.

Q: Why can an administrator not connect directly from the internet to an instance in a private subnet?
A: The instance has only a private IP and no direct route to an Internet Gateway. Administration must use an intermediate public host such as a bastion host.

Q: What is the difference between storing a private key on a bastion host and using SSH agent forwarding?
A: A key stored on the bastion is used locally for the second SSH hop; agent forwarding passes key-agent information through the first connection so the key need not be copied to the bastion.

Q: A private instance in Availability Zone A uses a NAT gateway in Availability Zone B. What availability concern should be recognized?
A: The instance depends on a gateway in another zone, so a failure affecting that gateway or its zone can disrupt internet access. A zone-local NAT gateway design avoids a single cross-zone dependency.

Q: Why is one NAT gateway insufficient for a multi-AZ high-availability design?
A: NAT gateway high availability is within its own Availability Zone, not automatically across all zones. A gateway failure can affect private instances in other zones that depend on it.

Q: How should private route tables be configured when using one NAT gateway per Availability Zone?
A: Each private subnet’s route table should point internet-bound traffic to the NAT gateway selected for its Availability Zone.

Q: Does assigning a public IP to an instance by itself make its subnet public?
A: No. The subnet also needs a route to an Internet Gateway for public routing; address assignment alone does not establish that path.

Q: What is the decisive difference between a NAT gateway and a bastion host in this lesson?
A: A NAT gateway provides outbound internet access for private instances, while a bastion host provides an administrative jump point for SSH access to private instances.

Q: A NAT gateway exists, but private instances cannot reach the internet. Which route-table relationship should be checked first?
A: Check whether the private subnet’s route table sends internet-bound traffic to the NAT gateway and whether the NAT gateway’s public subnet has a route to the Internet Gateway.

Practice Questions

Question 1

An operations team places an EC2 instance in a private subnet. The instance must download updates from the internet but must not receive direct inbound connections from the internet. Which design best fits the requirement?

A. Assign a public IP and add a route directly to the Internet Gateway
B. Deploy a NAT gateway in a public subnet and route the private subnet’s internet traffic to it
C. Deploy an Internet Gateway inside the private subnet
D. Place a bastion host in the private subnet and remove all routes

Correct answer: B. The requirement is outbound internet access without direct public addressing. A NAT gateway in a public subnet, referenced by the private route table, provides that path.

Question 2

Private instances in three Availability Zones all use one NAT gateway located in Availability Zone A. The organization wants internet egress to remain available when one Availability Zone fails. What change is most appropriate?

A. Assign public IPs to all private instances
B. Add an additional Internet Gateway to the VPC
C. Deploy a NAT gateway in each relevant Availability Zone and update private routes accordingly
D. Put all private instances into Availability Zone A

Correct answer: C. NAT gateway availability is scoped to its Availability Zone. Separate gateways and corresponding routes provide zone-level redundancy.

Question 3

An engineer can SSH from a laptop to a bastion host but cannot complete the SSH connection from the bastion to a private EC2 instance. What is the most relevant issue to investigate first based on this lesson?

A. Whether the private instance has an auto-assigned public IPv4 address
B. Whether the private instance’s route table points to an Internet Gateway
C. Whether the second SSH hop has access to the required private key or forwarded agent information
D. Whether the NAT gateway has a second Elastic IP

Correct answer: C. The second SSH connection still requires authentication. The private key must be available on the bastion, or SSH agent forwarding must be configured.

Question 4

An internet service logs the source address for requests from several private EC2 instances. All requests show the same public address. Which component explains this result?

A. The VPC’s Internet Gateway
B. The bastion host’s private IP
C. The NAT gateway’s Elastic IP
D. The subnet’s CIDR block

Correct answer: C. Network address translation causes the external service to see the NAT gateway’s Elastic IP rather than each instance’s private IP.

WordPress Metadata

Suggested Slug:
aws-private-subnets-nat-gateways-soa-c03

Meta Description:
Learn how AWS public and private subnets differ, how NAT gateways provide outbound internet access, and how to design bastion and multi-AZ connectivity patterns.

Tags:
AWS, AWS Certified CloudOps Engineer, VPC, Private Subnets, Public Subnets, NAT Gateway, Internet Gateway, Route Tables, Elastic IP, Bastion Host, SSH, High Availability