AWS Private Subnets and Bastion Hosts – SAP-C02 Study Guide

Purpose of This Lesson

This lesson demonstrates a common Amazon VPC access pattern: launching an EC2 instance in a private subnet and reaching it through a bastion host in a public subnet. It also highlights why private instances cannot receive direct inbound internet connections and why a separate solution is required for outbound internet access.

The same architecture appears frequently in SAP-C02 questions involving subnet design, route tables, administrative access, and network security.

Key Concepts

Public and private subnets

A subnet is considered public or private based primarily on its routing, not its name or the presence of a public IP address.

• A public subnet has a route to an Internet Gateway (IGW).
• A private subnet does not have a direct route to an Internet Gateway.
• An EC2 instance in a public subnet still needs a public IPv4 address or Elastic IP address for direct internet reachability.
• An instance in a private subnet normally has only a private IP address and cannot be reached directly from the internet.

A subnet can be created in a specific Availability Zone, such as us-east-1a, by selecting that Availability Zone during subnet creation. For production architectures, private subnets should generally be deployed across multiple Availability Zones.

Route tables determine subnet behavior

Every subnet is associated with a route table, either explicitly or through the VPC’s main route table association.

A typical public route table includes:

Destination       Target
VPC CIDR          local
0.0.0.0/0         Internet Gateway

A private route table may include only the local VPC route:

Destination       Target
VPC CIDR          local

For private workloads that need outbound IPv4 internet access, the private route table commonly contains:

Destination       Target
VPC CIDR          local
0.0.0.0/0         NAT Gateway

The NAT Gateway must be deployed in a public subnet whose route table sends internet-bound traffic to an Internet Gateway.

Bastion host pattern

A bastion host, or jump host, is an administrative EC2 instance in a public subnet. Administrators connect to the bastion and then use it to reach instances in private subnets.

The network flow is:

Administrator
    |
    | SSH to public IP
    v
Bastion host in public subnet
    |
    | SSH to private IP
    v
Private EC2 instance

The bastion host does not make the private instance public. The second connection travels over private VPC networking using the private IP address.

For the connection to work, the private instance’s security group must permit SSH from the bastion host. A preferred rule uses the bastion security group as the source rather than allowing SSH from the entire VPC CIDR or from 0.0.0.0/0.

Security group requirements

A secure bastion design typically uses separate security groups:

Bastion security group

• Inbound TCP 22 only from approved administrator IP ranges, VPN ranges, or a corporate network.
• Outbound traffic permitted to the private instances as required.

Private instance security group

• Inbound TCP 22 from the bastion security group.
• No inbound SSH rule from the public internet.
• Application-specific inbound rules only from the required load balancer, application tier, or administration path.

Security groups are stateful. Return traffic for an allowed connection is automatically permitted, subject to the security group’s rules.

SSH keys and multi-hop access

An SSH connection to the private instance requires a valid private key corresponding to the public key installed on that instance. The bastion host must not automatically receive the administrator’s private key.

Safer approaches include:

• SSH agent forwarding, used carefully and only from trusted bastions.
• AWS Systems Manager Session Manager, which avoids inbound SSH exposure and key distribution.
• EC2 Instance Connect or EC2 Instance Connect Endpoint where supported.
• A controlled enterprise access gateway or privileged access management system.

Copying a private key into a bastion host can work technically, but it increases the impact of a bastion compromise and is generally a poor production practice.

Outbound internet access from private subnets

A private subnet blocks direct inbound internet access, but it also lacks internet-bound routing unless a NAT design is added.

For IPv4 workloads:

1. Deploy a NAT Gateway in a public subnet.
2. Ensure the public subnet routes 0.0.0.0/0 to an Internet Gateway.
3. Add a default route from the private subnet route table to the NAT Gateway.
4. Ensure network ACLs and security groups allow the traffic.

A NAT Gateway provides outbound connectivity initiated by private resources. It does not allow unsolicited inbound connections from the internet.

For high availability, use a NAT Gateway in each Availability Zone and route each private subnet to the NAT Gateway in the same Availability Zone. A single centralized NAT Gateway can reduce cost in some designs but introduces cross-AZ data transfer and an Availability Zone dependency.

Exam-Relevant Takeaways

• A subnet is public because its route table has a route to an Internet Gateway—not merely because it is configured in a VPC.
• An EC2 instance needs a public IPv4 address or Elastic IP, plus a route through an Internet Gateway, for direct IPv4 internet access.
• A private EC2 instance can be accessed through a bastion using its private IP address if routing and security groups permit it.
• The private instance should allow SSH from the bastion’s security group, not from the whole internet.
• A NAT Gateway enables outbound internet access from private IPv4 subnets; it does not provide inbound access.
• NAT Gateways are AZ-specific resources. For resilient designs, deploy one per Availability Zone when appropriate.
• Route table associations are essential. Creating a private subnet without associating it with the intended route table can leave it using the VPC’s main route table.
• Session Manager is often a better operational choice than maintaining bastion hosts, provided the instance has the required IAM permissions, SSM Agent, and network connectivity to Systems Manager endpoints.
• Never assume that the name private-subnet makes a subnet private. Inspect the route table.

Architecture Decision Guide

Requirement	Recommended approach	Important considerations
Administrators need occasional shell access to private EC2 instances	Systems Manager Session Manager	Requires SSM Agent, IAM instance role, and access to Systems Manager endpoints
A traditional SSH jump path is required	Bastion host in a public subnet	Restrict inbound SSH, harden and monitor the host, and avoid storing private keys on it
Private IPv4 instances need package downloads or API access	NAT Gateway in a public subnet	Add private route table routes; NAT Gateway does not accept unsolicited inbound traffic
Private instances need to access AWS services without traversing the public internet	VPC endpoints	Use gateway endpoints for supported services such as Amazon S3 and DynamoDB; interface endpoints for many other AWS services
Private instances need resilient outbound access across AZs	NAT Gateway per AZ	Improves AZ independence but increases hourly and data-processing cost
The private instance must accept application traffic	Load balancer or private service path	Do not expose the instance directly; permit traffic from the appropriate security group

Common Exam Traps

• Confusing a public IP with a public subnet: Both routing and addressing matter for direct internet access.
• Adding a NAT Gateway to the private subnet: A NAT Gateway must be placed in a public subnet so it can reach the Internet Gateway.
• Using an Internet Gateway for private instances: An IGW does not provide private-subnet egress by itself. Use NAT for IPv4 outbound access.
• Allowing SSH from 0.0.0.0/0: This defeats much of the security benefit of a bastion architecture.
• Assuming the bastion can reach the private host automatically: The route tables, network ACLs, security groups, and SSH credentials must all be correct.
• Using one NAT Gateway without considering AZ failure: A single NAT Gateway may become a cross-AZ dependency or an outage point for private subnets in other AZs.
• Copying private keys onto shared infrastructure: This creates key-exposure risk. Prefer Session Manager or carefully designed agent-based access.
• Forgetting route table association: A newly created subnet may inherit the main route table unless explicitly associated with another table.

Real-World Engineer Notes

A bastion host is a legacy but still valid pattern when direct SSH is required. Treat it as a highly privileged security boundary:

• Use a minimal operating system image and keep it patched.
• Restrict source IPs with security group rules and, where applicable, corporate VPN or Direct Connect connectivity.
• Avoid assigning broad IAM permissions to the bastion.
• Log authentication and shell activity using centralized logging and security monitoring.
• Use short-lived credentials and rotate access keys.
• Consider replacing the bastion with Systems Manager Session Manager, which removes the need for inbound port 22 and public bastion IP addresses.

For production subnet design, use separate public and private route tables and deploy private resources across multiple Availability Zones. Use VPC endpoints for high-volume access to supported AWS services when that is more secure and less expensive than routing all traffic through a NAT Gateway.

Quick Reference Summary

• Public subnet: Route to an Internet Gateway.
• Private subnet: No direct route to an Internet Gateway.
• Bastion host: Public administrative jump host used to reach private instances.
• Private instance access: Connect to the bastion first, then use the target’s private IP.
• SSH security: Permit private-instance SSH from the bastion security group.
• Private IPv4 egress: Private route table default route to a NAT Gateway.
• NAT placement: NAT Gateway in a public subnet, backed by an Internet Gateway route.
• High availability: Prefer one NAT Gateway per AZ when AZ isolation is required.
• Modern alternative: Session Manager, EC2 Instance Connect, or private access services instead of a bastion.

Flashcards

1. Q: What makes a subnet public?

A: Its associated route table has a route to an Internet Gateway.

1. Q: Does an EC2 instance in a public subnet automatically have internet access?

A: No. It also needs a public IPv4 address or Elastic IP and appropriate security group and network ACL rules.

1. Q: What is the purpose of a bastion host?

A: It provides a controlled administrative entry point to resources in private subnets.

1. Q: Which IP address is used when connecting from a bastion to a private EC2 instance?

A: The private IP address of the target instance.

1. Q: What should the private instance’s SSH security group rule use as its source?

A: The bastion host’s security group, where possible.

1. Q: What AWS service provides outbound IPv4 internet access for private subnets?

A: A NAT Gateway, typically deployed in a public subnet.

1. Q: Does a NAT Gateway allow inbound internet connections to private instances?

A: No. It supports connections initiated from private resources.

1. Q: Why can a single NAT Gateway be a resilience concern?

A: It creates an Availability Zone dependency and may require cross-AZ routing for private subnets in other AZs.

1. Q: What is a more secure alternative to copying a private SSH key onto a bastion?

A: Systems Manager Session Manager, EC2 Instance Connect, or carefully controlled SSH agent forwarding.

1. Q: What happens if a new private subnet is not explicitly associated with a private route table?

A: It uses the VPC’s main route table, which may accidentally provide public routing.

1. Q: Can an Internet Gateway provide outbound access for an instance with only a private IP?

A: Not as a general private-subnet egress solution. Use a NAT Gateway for IPv4 private-subnet egress.

1. Q: What is the primary purpose of separate public and private route tables?

A: To apply different routing policies and prevent private resources from having direct internet routes.

Practice Questions

Question 1

A company runs application servers in private subnets. Administrators need SSH access, but the security team requires that application servers have no public IP addresses and that port 22 not be open to the internet. Which design best meets these requirements?

A. Assign Elastic IP addresses to the application servers and restrict SSH to the corporate CIDR range.

B. Deploy a bastion host in a public subnet, restrict its SSH source ranges, and allow the application servers’ security group to accept SSH from the bastion security group.

C. Add an Internet Gateway route to the private subnet and restrict SSH using a network ACL.

D. Deploy a NAT Gateway in the private subnet and use it for inbound SSH.

Correct answer: B

Explanation: A bastion provides a controlled jump path without exposing the private servers. The private servers should allow SSH from the bastion security group. NAT Gateways support outbound connections, not inbound SSH, and an Internet Gateway route would make the subnet public.

Question 2

EC2 instances in a private subnet must download operating system updates from the internet. The instances must not accept unsolicited inbound internet traffic. Which architecture should be implemented?

A. Add a default route from the private subnet to an Internet Gateway.

B. Assign public IP addresses to the instances and allow outbound HTTPS.

C. Deploy a NAT Gateway in a public subnet and route private-subnet internet traffic to it.

D. Deploy a bastion host and route all application traffic through it.

Correct answer: C

Explanation: A NAT Gateway provides outbound IPv4 connectivity for private instances while preventing unsolicited inbound connections. It must be in a public subnet with a route to an Internet Gateway.

Question 3

A private subnet was created for sensitive EC2 instances. The instances unexpectedly have internet connectivity. Which action should the solutions architect take first?

A. Remove the VPC’s local route from the route table.

B. Inspect the subnet’s route table association and remove any default route targeting an Internet Gateway.

C. Disable source/destination checks on the EC2 instances.

D. Replace the security group with a network ACL.

Correct answer: B

Explanation: Subnet classification is determined by routing. The architect should verify which route table is associated with the subnet and check for a default route to an Internet Gateway. The local VPC route is required and should not be removed.

Question 4

A workload is deployed in private subnets in three Availability Zones. It requires outbound access to public software repositories. The architect wants to avoid making one Availability Zone a dependency for the other two. Which design is most resilient?

A. Deploy one NAT Gateway in a single public subnet and route all private subnets to it.

B. Deploy one NAT Gateway in each Availability Zone and route each private subnet to the NAT Gateway in the same AZ.

C. Deploy one Internet Gateway in each Availability Zone and route private subnets directly to them.

D. Assign Elastic IP addresses to all private instances.

Correct answer: B

Explanation: NAT Gateways are AZ-specific. One per AZ provides AZ-local egress and avoids relying on another AZ for connectivity. This costs more than a centralized design but improves resilience and reduces cross-AZ dependency.

Question 5

An organization wants to eliminate inbound SSH access and avoid distributing SSH private keys while retaining operational access to private EC2 instances. The instances have SSM Agent installed and can reach the required Systems Manager endpoints. What should the architect recommend?

A. Use AWS Systems Manager Session Manager with an appropriate instance IAM role.

B. Store the SSH private key in an S3 bucket and download it when needed.

C. Copy the SSH private key to every bastion host.

D. Place all instances in public subnets and use EC2 Instance Connect over port 22.

Correct answer: A

Explanation: Session Manager provides shell access without requiring inbound SSH, bastion hosts, or administrator-managed private keys. The instance needs the required SSM components, IAM permissions, and network connectivity to Systems Manager services.