AWS Private Subnets and Bastion Hosts – SAP-C02 Study Guide

Purpose of This Lesson

Amazon EC2 instances in private subnets are intentionally not directly reachable from the public internet. This design improves security, but administrators still need a controlled way to access those instances for troubleshooting and operations.

This lesson explains:

• How AWS distinguishes public and private subnets
• The role of route tables and internet gateways
• How a bastion host, or jump host, provides administrative access to private instances
• The security and architecture tradeoffs of this pattern

Key Concepts

Public and private subnet behavior

A subnet is considered public when its associated route table contains a route to an internet gateway and resources in the subnet can use public addressing. A typical public-subnet route table includes:

Destination	Target	Purpose
VPC CIDR, such as 10.0.0.0/16	local	Routes traffic within the VPC
0.0.0.0/0	Internet gateway	Routes IPv4 internet-bound traffic externally

A private subnet normally has only the local VPC route, or may have routes to other private networking components such as a NAT gateway, transit gateway, or virtual private gateway. It does not have a default route directly to an internet gateway.

A subnet itself does not have an internet connection independently of its route table. The combination of routing and addressing determines whether resources can communicate publicly.

Public IP addressing matters

An internet gateway performs network address translation for resources that have a public IPv4 address or an associated Elastic IP address. An EC2 instance with only a private IP address cannot be directly reached from the internet through an internet gateway.

For an EC2 instance to be publicly reachable, the design generally requires:

1. A subnet route table with a default route to an internet gateway
2. A public IPv4 address or Elastic IP on the instance
3. Security group rules allowing the required inbound traffic
4. Network ACLs that do not block the traffic
5. The operating system and application configured to accept the connection

A public subnet does not automatically make every resource reachable. For example, instances launched without public IP addresses remain inaccessible directly from the internet even if the subnet is public.

Local VPC routing

Every VPC route table includes a local route for the VPC CIDR. This route enables communication between private IP addresses in the VPC, subject to security groups, network ACLs, and other controls.

Consequently, an instance in a public subnet can communicate with an instance in a private subnet using the private instance address. The availability zones may be the same or different; VPC routing still applies, although cross-AZ traffic can have cost and resiliency implications.

Bastion host architecture

A bastion host is an EC2 instance in a public subnet used as an administrative entry point to instances in private subnets.

The typical connection flow is:

1. An administrator connects from an approved external source to the bastion host using SSH or RDP.
2. The bastion host connects to the private EC2 instance over the VPC network using its private IP address or private DNS name.
3. The private instance does not need a public IP address or a direct route to an internet gateway.

This is commonly called a jump host pattern.

Security group design

A secure bastion architecture uses narrowly scoped security group rules:

• Bastion security group inbound: allow SSH on TCP port 22, or RDP on TCP port 3389, only from approved administrator IP ranges, a corporate VPN, or a controlled access service.
• Private instance security group inbound: allow SSH or RDP only from the bastion security group, not from 0.0.0.0/0.
• Bastion security group outbound: allow only the required connections to private instances where practical.

Referencing the bastion security group as the source of the private instance rule is generally preferable to hard-coding the bastion’s private IP address. Security group references automatically apply to members of the referenced group within supported VPC connectivity scenarios.

Bastion hosts are not the same as NAT gateways

These components solve different problems:

• Bastion host: enables administrators to initiate inbound management connections to private instances through a controlled intermediary.
• NAT gateway: allows resources in private subnets to initiate outbound IPv4 connections to the internet. It does not allow unsolicited inbound connections from the internet.

A NAT gateway does not replace a bastion host for interactive SSH or RDP access. Likewise, a bastion host should not normally be used as a general-purpose NAT device.

Exam-Relevant Takeaways

• A route to an internet gateway is what makes a subnet public from a routing perspective; the route is configured in the subnet’s associated route table.
• Private subnets do not have a direct default route to an internet gateway.
• An EC2 instance in a private subnet can communicate with other VPC resources through the VPC’s local route.
• A public IP address is required for direct internet communication through an internet gateway.
• A bastion host is deployed in a public subnet and provides a controlled jump point to private instances.
• Security groups are stateful. Return traffic for an allowed connection is automatically permitted.
• Network ACLs are stateless and can independently block traffic even when security groups are correct.
• For highly available bastion access, deploy bastion hosts across multiple Availability Zones and use appropriate operational controls.
• For many modern architectures, AWS Systems Manager Session Manager is safer than exposing SSH or RDP to the internet because it can provide private access without inbound ports.

Architecture Decision Guide

Requirement	Recommended approach	Important considerations
Public web application endpoint	Public load balancer in public subnets; application instances in private subnets	Avoid assigning public IPs to application instances unless specifically required
Occasional administrator access to private EC2 instances	AWS Systems Manager Session Manager	Requires SSM Agent, IAM permissions, and connectivity to Systems Manager endpoints
SSH or RDP access where Session Manager is unavailable	Bastion host in a public subnet	Restrict source CIDRs, harden the host, log access, and patch it regularly
Private instances need outbound IPv4 internet access	NAT gateway in a public subnet with a private-subnet route to it	NAT gateway is outbound-only from the private subnet; deploy per AZ when resilience and cost justify it
Private instances need access to AWS services without public internet traversal	VPC endpoints, preferably gateway or interface endpoints as supported	Review endpoint policies, private DNS, route requirements, and cost
Centralized administrative access across multiple VPCs	Session Manager, centralized network connectivity, or a controlled shared-services access pattern	Consider Transit Gateway, IAM boundaries, logging, and organizational governance

Common Exam Traps

• Assuming a public subnet automatically makes instances public: An instance also needs a public IPv4 address or Elastic IP and permissive—but appropriately restricted—security controls.
• Putting a bastion host in a private subnet: External administrators cannot reach it directly unless another private connectivity mechanism, such as VPN or Direct Connect, is already available.
• Opening the private instance to the internet: The private instance’s security group should normally allow management traffic from the bastion security group, not from 0.0.0.0/0.
• Using a NAT gateway for inbound administration: NAT gateways support return traffic for connections initiated from private resources; they are not inbound jump hosts.
• Treating route tables as security controls: Route tables determine paths, but security groups and network ACLs also affect whether traffic is permitted.
• Forgetting the return path: Connectivity requires appropriate routes in both directions. Security groups are stateful, but network ACLs are not.
• Assuming the bastion pattern is always preferred: Session Manager can remove the need for public administrative ports and is often the stronger security choice when its prerequisites are available.
• Using one bastion as a single point of failure: A single host can prevent administrative access if its Availability Zone or instance fails. Consider multiple hosts or a managed access solution.

Real-World Engineer Notes

• Place application and database tiers in private subnets by default. Public exposure should usually be limited to load balancers, NAT gateways, and explicitly approved edge services.
• Protect bastion hosts as high-value assets. Use hardened AMIs, minimal installed software, patching, centralized logging, short-lived credentials, and MFA-backed administrative workflows where possible.
• Avoid sharing private keys broadly. Use Systems Manager, EC2 Instance Connect where suitable, or a controlled secrets and certificate-management process.
• Restrict bastion ingress to corporate egress addresses, VPN ranges, or identity-aware access controls. Never use unrestricted SSH or RDP as a convenience setting.
• If a private instance must reach the internet only for software updates, use a NAT gateway, VPC endpoints, or an internal repository rather than assigning it a public IP.
• For multi-AZ production environments, account for bastion availability, cross-AZ traffic, and the operational impact of losing one access path.
• Record administrative sessions and connection attempts using services such as AWS CloudTrail, Systems Manager logging, VPC Flow Logs, and host-level audit logs where appropriate.

Quick Reference Summary

• Public subnet: Route table includes a route to an internet gateway.
• Private subnet: No direct route to an internet gateway; instances normally have only private addresses.
• Local route: Enables private-IP communication within the VPC CIDR.
• Bastion host: Publicly reachable administrative jump host that connects to private instances over private networking.
• NAT gateway: Enables outbound internet access from private subnets; it is not an inbound access mechanism.
• Best-practice management option: Prefer AWS Systems Manager Session Manager when feasible to avoid exposing SSH or RDP.
• Security model: Combine route tables, security groups, network ACLs, IAM, host hardening, and logging.

Flashcards

1. Q: What makes a subnet public?

A: Its associated route table has a route to an internet gateway, and resources can use public addressing when required.

1. Q: What does 0.0.0.0/0 represent?

A: All IPv4 destinations not matched by a more specific route.

1. Q: What is the purpose of the VPC local route?

A: It routes traffic between private IP addresses within the VPC CIDR.

1. Q: Why cannot an EC2 instance with only a private IP be directly reached from the internet?

A: It has no public address for internet gateway translation and normally has no direct public ingress path.

1. Q: What is a bastion host?

A: A controlled jump host, typically in a public subnet, used to access instances in private subnets.

1. Q: What should the private instance security group allow for SSH from a bastion?

A: TCP port 22 from the bastion host’s security group rather than from the entire internet.

1. Q: Does a NAT gateway allow inbound SSH from the internet?

A: No. It supports return traffic for connections initiated from private resources.

1. Q: What AWS service can replace many bastion-host use cases?

A: AWS Systems Manager Session Manager.

1. Q: Are security groups stateful or stateless?

A: Stateful; return traffic for an allowed connection is automatically allowed.

1. Q: Are network ACLs stateful or stateless?

A: Stateless; inbound and outbound rules must both permit the traffic.

Practice Questions

Question 1

A company runs EC2 application servers in private subnets. Administrators need occasional SSH access, but security policy prohibits inbound port 22 from the public internet. The instances have no public IP addresses. Which solution best satisfies the requirement with the least exposure?

A. Deploy a NAT gateway and connect through its Elastic IP address
B. Deploy a bastion host and allow SSH from 0.0.0.0/0
C. Use AWS Systems Manager Session Manager with appropriate IAM permissions and managed-instance connectivity
D. Add an internet gateway route to the private subnet

Correct answer: C

Explanation: Session Manager provides interactive access without requiring inbound SSH exposure. A NAT gateway is for outbound connections, an unrestricted bastion violates the security requirement, and adding an internet gateway route would make the private-subnet design less restrictive.

Question 2

An engineer launches an EC2 instance in a subnet whose route table contains 0.0.0.0/0 to an internet gateway. The instance cannot be reached from the internet. Which missing configuration is the most likely cause?

A. A local route for the VPC CIDR
B. A public IPv4 address or Elastic IP on the instance
C. A NAT gateway in the same Availability Zone
D. A VPC peering connection

Correct answer: B

Explanation: A route to an internet gateway alone does not assign a public address. The instance needs a public IPv4 address or Elastic IP, along with appropriate security group and network ACL rules.

Question 3

A private EC2 instance must download operating system updates from public repositories. It must not accept unsolicited inbound connections from the internet. Which architecture is appropriate?

A. Assign a public IPv4 address and allow inbound TCP port 22
B. Place the instance in a public subnet with an internet gateway route
C. Place the instance in a private subnet and route its default traffic to a NAT gateway in a public subnet
D. Place the instance behind a bastion host and use the bastion as a proxy for all internet traffic

Correct answer: C

Explanation: A NAT gateway provides outbound IPv4 internet access for private instances while preventing unsolicited inbound connections. A bastion host is an administrative access pattern, not the standard solution for general outbound updates.

Question 4

A bastion host in a public subnet can connect to a private EC2 instance, but the private instance rejects the SSH connection. The route tables contain the VPC local route in both subnets. Which change is most appropriate?

A. Add an internet gateway route to the private subnet
B. Add an inbound SSH rule to the private instance security group whose source is the bastion security group
C. Assign an Elastic IP to the private instance
D. Replace the local route with a NAT gateway route

Correct answer: B

Explanation: VPC local routing already supports private-IP communication. The private instance security group must allow SSH from the bastion security group. Public addressing and an internet gateway are unnecessary for this private connection.

Question 5

A production environment uses one bastion host in a single Availability Zone. During an Availability Zone outage, administrators lose access to instances in other zones. Which improvement best addresses the availability issue while preserving the bastion approach?

A. Add more inbound ports to the existing bastion
B. Deploy bastion hosts across multiple Availability Zones and use controlled access to each
C. Move all private instances into the bastion’s Availability Zone
D. Replace the private-subnet route with a route to the internet gateway

Correct answer: B

Explanation: Multiple bastion hosts across Availability Zones remove the single-AZ dependency. The design should still restrict access and may be replaced or supplemented by Session Manager for a lower-exposure operational model.