How EC2 Public IPv4 Address Translation Works – SAP-C02 Study Guide | AWS Systems Architect Professional

Study guide

Technical reference and lesson notes

Purpose of This Lesson

Amazon EC2 instances commonly have a private IPv4 address on their elastic network interface and may also have a public IPv4 address or Elastic IP address. However, the public address is not configured inside the instance operating system.

AWS performs the public-to-private address mapping outside the instance, through the VPC’s Internet gateway. Understanding this behavior helps explain why operating-system commands show only the private address and is important when troubleshooting public connectivity.

Key Concepts

EC2 instances use private addresses internally

An EC2 instance’s network interface is configured with a private IPv4 address from the subnet’s CIDR range. Commands such as the following normally show this private address:

ip address show eth0
ifconfig
ipconfig

The instance does not have its public IPv4 address assigned to the operating system network interface.

Public IPv4 addresses are mapped externally

When an instance has a public IPv4 address, AWS maintains a one-to-one mapping between that public address and the instance’s private IPv4 address. The mapping is implemented outside the guest operating system by the VPC networking infrastructure, with the Internet gateway performing the public IPv4 address translation.

For outbound traffic:

The instance sends a packet using its private IPv4 address as the source.
The Internet gateway translates the source to the instance’s public IPv4 address or Elastic IP.
The packet is sent to the internet.

For inbound traffic:

A client sends traffic to the instance’s public IPv4 address.
The Internet gateway translates the destination to the associated private IPv4 address.
The instance receives the traffic through its network interface using the private address.

Although the public address is visible in the EC2 console and through AWS APIs, it is not normally visible from inside the instance.

Internet gateway versus NAT gateway

These services have different roles:

Internet gateway: Provides connectivity between a VPC and the internet and performs address translation for resources with public IPv4 addresses or Elastic IPs.
NAT gateway: Allows instances in private subnets to initiate outbound IPv4 connections to the internet without accepting unsolicited inbound internet connections. It does not provide public inbound access to private instances.

A public EC2 address is translated by the Internet gateway. A private-subnet instance typically sends traffic through a NAT gateway, which uses its own public Elastic IP for internet-bound traffic.

Public IPv4 addresses and Elastic IP addresses

An automatically assigned public IPv4 address is generally associated with the instance lifecycle and can change when the instance is stopped and started.

An Elastic IP address is a static public IPv4 address allocated to the AWS account. It can be associated with an instance or network interface and can be remapped when required, subject to AWS account and service limits.

Elastic IPs are useful when a stable public IPv4 address is required, but they should not be used as a substitute for highly available application architecture. For resilient systems, prefer services such as load balancers, DNS-based routing, or managed endpoints where appropriate.

IPv6 behaves differently

IPv6 addresses are globally routable and are not translated using NAT in the usual VPC design. An instance with an IPv6 address can communicate directly with the internet through an Internet gateway, provided that routing and security controls permit the traffic.

Security groups, network ACLs, and host-based firewalls still apply to IPv6 traffic.

Exam-Relevant Takeaways

The EC2 operating system normally sees the private IPv4 address, not the public IPv4 address.
The public IPv4 address is mapped externally by AWS rather than configured on the guest network interface.
The Internet gateway performs the public IPv4 address translation for resources with public IP addresses.
A public IPv4 address does not bypass security controls. The subnet route table, security group, network ACL, and host firewall must all allow the traffic.
A public IPv4 address requires a route to an Internet gateway for internet connectivity.
An instance in a private subnet does not become publicly reachable merely because it can make outbound connections through a NAT gateway.
A NAT gateway provides outbound IPv4 connectivity for private resources and normally blocks unsolicited inbound connections.
Use an Elastic IP when a stable public IPv4 address is required; do not expect an automatically assigned public IPv4 address to remain stable across stop/start operations.
IPv6 uses globally routable addresses and does not require NAT for internet access.

Architecture Decision Guide

Requirement	Appropriate design	Important consideration
EC2 instance needs direct public IPv4 connectivity	Public subnet, route to an Internet gateway, public IPv4 or Elastic IP	Configure security groups, network ACLs, and host firewall rules
Private instances need outbound IPv4 internet access	NAT gateway in a public subnet, with private-subnet routes pointing to it	NAT gateways are not inbound proxies and incur hourly and data-processing charges
Stable public IPv4 address for a resource	Elastic IP address	Manage address allocation carefully and avoid unnecessary idle Elastic IPs
Highly available public application	Application or Network Load Balancer, DNS, and multiple Availability Zones	Avoid making a single EC2 instance and its Elastic IP the availability design
Internet connectivity without IPv4 translation	Assign IPv6 addressing and route through an Internet gateway	IPv6 security rules must be configured separately; IPv4 and IPv6 are distinct protocols

Common Exam Traps

Assuming the public IP appears inside the instance: It usually does not. Guest operating-system commands show the private address.
Confusing the Internet gateway with a NAT gateway: The Internet gateway handles public address translation for public IPv4 resources. A NAT gateway enables private resources to initiate outbound IPv4 connections.
Assuming a public IP makes an instance reachable: A public address is only one requirement. Routing and security controls must also permit the connection.
Assuming a private subnet has no internet access: Private instances can have outbound IPv4 access through a NAT gateway, while remaining unreachable from unsolicited inbound internet traffic.
Treating an automatically assigned public IP as permanent: It can change after an instance stop/start cycle. Use an Elastic IP or a higher-level endpoint when stability is required.
Applying IPv4 NAT assumptions to IPv6: IPv6 addresses are globally routable and generally use routing rather than NAT.
Using an Elastic IP as a high-availability mechanism: An Elastic IP can be remapped, but it does not by itself eliminate instance, Availability Zone, or application failure risks.

Real-World Engineer Notes

To discover an instance’s public address from AWS, use the EC2 console, AWS CLI, instance metadata, or the relevant EC2 API—not only operating-system interface commands.
Instance metadata can expose the local private address and public address information, but applications should retrieve only the metadata they need and use IMDSv2 where possible.
When troubleshooting inbound traffic, verify the complete path: DNS resolution, public-to-private mapping, subnet route table, security group, network ACL, operating-system firewall, and the application listener.
An application that binds to the private interface can still be reachable through its public address because AWS translates the destination before delivery to the instance.
For production web applications, place instances behind a load balancer rather than relying on a single instance’s public address.
Public IPv4 addresses are increasingly costly and limited resources. Prefer private connectivity, managed service endpoints, or IPv6 where the architecture and client ecosystem support them.

Quick Reference Summary

EC2 network interfaces are configured with private IPv4 addresses.
Public IPv4 addresses are associated externally, not assigned inside the guest operating system.
The Internet gateway performs one-to-one public IPv4 translation for public EC2 addresses.
NAT gateways provide outbound IPv4 internet access for private subnets.
Elastic IPs provide stable public IPv4 addresses but do not provide high availability by themselves.
Public reachability requires correct routing and security controls.
IPv6 uses global addressing and does not require NAT.

Flashcards

Q: Which address does an EC2 operating system normally see on its network interface?

A: The private IPv4 address assigned to the network interface.

Q: Where is an EC2 public IPv4 address mapped to the instance’s private IPv4 address?

A: Outside the instance, through AWS VPC networking and the Internet gateway.

Q: What happens to the source address of outbound traffic from an EC2 instance with a public IPv4 address?

A: The Internet gateway translates the private source address to the associated public IPv4 address.

Q: What happens to inbound traffic sent to an EC2 public IPv4 address?

A: The Internet gateway translates the public destination to the instance’s private IPv4 address.

Q: Does a NAT gateway make a private EC2 instance directly reachable from the internet?

A: No. It provides outbound connectivity for connections initiated by private resources.

Q: Which service connects a VPC to the internet?

A: An Internet gateway.

Q: When should an Elastic IP be considered?

A: When a stable public IPv4 address is required for a resource or endpoint.

Q: Can an automatically assigned public IPv4 address change?

A: Yes. It can change when an instance is stopped and started.

Q: Does an Elastic IP alone make an instance highly available?

A: No. It provides address stability, not redundancy or automatic failover by itself.

Q: Does IPv6 require NAT for internet connectivity?

A: No. IPv6 addresses are globally routable, subject to routing and security controls.

Practice Questions

Question 1

An architect launches an EC2 instance with an automatically assigned public IPv4 address. From the instance, the administrator runs ip address and sees only a private IPv4 address. What best explains this behavior?

A. The instance has not completed DHCP configuration.
B. The public IPv4 address is mapped externally by the VPC networking infrastructure.
C. The security group is hiding the public address.
D. The public IPv4 address is available only through a NAT gateway.

Correct answer: B

The public IPv4 address is not configured on the guest operating system interface. AWS maps it externally to the instance’s private IPv4 address through the Internet gateway.

Question 2

A company places application servers in a private subnet. The servers must download operating-system updates from the internet, but internet clients must not initiate connections to the servers. Which design meets the requirement?

A. Assign an Elastic IP to each server.
B. Add a route from the private subnet directly to the Internet gateway.
C. Deploy a NAT gateway in a public subnet and route private-subnet traffic to it.
D. Place the servers in a public subnet without public IP addresses.

Correct answer: C

A NAT gateway provides outbound IPv4 connectivity for private-subnet resources while preventing unsolicited inbound internet connections. The NAT gateway needs a route to an Internet gateway and normally uses an Elastic IP.

Question 3

A single EC2 instance hosts a production API. Clients require a stable endpoint, and the architect is considering assigning an Elastic IP directly to the instance. Which statement is most accurate?

A. An Elastic IP automatically provides multi-AZ failover.
B. An Elastic IP is stable, but additional mechanisms are required for high availability.
C. An Elastic IP is visible as a second address inside the instance operating system.
D. An Elastic IP can be used only for outbound traffic.

Correct answer: B

An Elastic IP provides a stable public IPv4 address that can be remapped, but it does not make the instance redundant. A load balancer, DNS strategy, or automated failover design may be more appropriate for production availability.

Question 4

An EC2 instance has a public IPv4 address, a route to an Internet gateway, and a security group allowing TCP port 443. Clients still cannot connect. Which conclusion is correct?

A. The instance cannot receive traffic because EC2 supports only private addresses.
B. The public address guarantees connectivity, so the problem must be outside AWS.
C. Additional controls, such as network ACLs, host firewall rules, or the application listener, may still block traffic.
D. The instance must use a NAT gateway for inbound traffic.

Correct answer: C

Public addressing and routing do not override security controls. Network ACLs, the operating-system firewall, and the application’s listening configuration must also allow the connection.

Question 5

A solution uses IPv6 addresses on EC2 instances and routes traffic through an Internet gateway. Which statement describes the addressing model?

A. The Internet gateway must translate every IPv6 address to a private IPv4 address.
B. IPv6 generally uses globally routable addresses without IPv4 NAT.
C. IPv6 instances require a NAT gateway for both inbound and outbound traffic.
D. IPv6 addresses are visible only in the AWS console, not inside the instance.

Correct answer: B

IPv6 provides globally routable addresses. Connectivity still depends on route tables and security controls, but IPv4 NAT is not required for normal IPv6 internet access.