Study guide
Technical reference and lesson notes
Purpose of This Lesson
A private-subnet EC2 instance can communicate with resources inside its VPC but cannot access the public internet unless the VPC provides an outbound path. This lesson demonstrates how to use a NAT Gateway in a public subnet so instances in a private subnet can initiate outbound internet connections without becoming directly reachable from the internet.
The design also includes a bastion host in a public subnet for administrative access to the private instance.
Key Concepts
Private and public subnet routing
A subnet is considered public or private based primarily on its route table:
- A public subnet has a route such as
0.0.0.0/0pointing to an Internet Gateway. - A private subnet does not have a direct route to an Internet Gateway.
- A private subnet can still have a default route to a NAT Gateway, enabling outbound internet access.
The subnet’s route table determines how traffic leaves the subnet. The instance’s security group does not provide internet connectivity by itself.
NAT Gateway placement
A public NAT Gateway must be deployed in a public subnet. That subnet needs a route to an Internet Gateway, and the NAT Gateway requires an Elastic IP address for internet communication.
The private instance does not route directly to the Internet Gateway. Instead, its traffic follows this path:
Private EC2 instance
|
Private subnet route table: 0.0.0.0/0 -> NAT Gateway
|
NAT Gateway in a public subnet
|
Internet Gateway
|
Internet
Route table configuration
The private subnet’s route table normally contains a local route for the VPC CIDR block, for example:
Destination Target
10.0.0.0/16 local
0.0.0.0/0 nat-xxxxxxxx
The local route handles communication within the VPC. The 0.0.0.0/0 route matches all destinations not covered by more specific routes and sends that traffic to the NAT Gateway.
Outbound-only behavior
A NAT Gateway allows resources in private subnets to initiate connections to external destinations. It does not provide unsolicited inbound access from the internet to those private instances.
This makes the pattern useful for activities such as:
- Downloading operating system updates
- Accessing public package repositories
- Calling external APIs
- Retrieving software or container images
The NAT Gateway tracks the outbound connection and translates the private source address. Return traffic is sent back through the NAT Gateway to the originating private instance.
Elastic IP lifecycle
A NAT Gateway requires an Elastic IP address. When the NAT Gateway is deleted, its Elastic IP may remain allocated. The Elastic IP cannot be released while it is still associated with the NAT Gateway.
A typical cleanup sequence is:
- Delete the NAT Gateway.
- Wait until the NAT Gateway is fully deleted.
- Refresh the console or query AWS again.
- Release the now-unassociated Elastic IP.
- Terminate temporary EC2 instances and remove other lab resources.
Exam-Relevant Takeaways
- A NAT Gateway is deployed in a public subnet, not a private subnet.
- The private subnet route table must contain a default route to the NAT Gateway.
- The NAT Gateway’s public connectivity comes from the public subnet’s route to an Internet Gateway.
- A NAT Gateway requires an Elastic IP address.
- A NAT Gateway supports outbound connections from private resources; it is not an inbound publishing mechanism.
- The NAT Gateway must be in the same VPC as the private resources using it.
- Security groups and network ACLs must also allow the intended traffic. Correct routing alone is not sufficient.
- NAT Gateways are billed resources. A production design should account for hourly charges and data processing charges.
- For high availability, deploy a NAT Gateway in each Availability Zone and route each private subnet to the NAT Gateway in its own Availability Zone.
- A bastion host and a NAT Gateway solve different problems:
- A bastion host provides an administrative entry point into private resources.
- A NAT Gateway provides outbound internet access for private resources.
Architecture Decision Guide
| Requirement | Recommended design | Important consideration |
|---|---|---|
| Private EC2 instance needs outbound internet access | NAT Gateway in a public subnet plus a private-subnet default route | Requires an Elastic IP and incurs charges |
| Administrators need SSH access to a private instance | Bastion host in a public subnet, or preferably a managed access service where appropriate | Restrict access with security groups and avoid exposing private instances directly |
| Private instances need only AWS service access | Use VPC endpoints where supported | Can reduce NAT dependency, cost, and internet exposure |
| High availability across multiple Availability Zones | One NAT Gateway per Availability Zone | Prevents a single-AZ NAT failure from affecting all private subnets |
| Centralized egress for multiple VPCs | Consider a centralized inspection or egress architecture using services such as Transit Gateway | Adds routing and operational complexity |
| No inbound internet access should be allowed | Keep instances in private subnets and use NAT only for outbound sessions | Do not add an Internet Gateway route to the private route table |
Common Exam Traps
Putting the NAT Gateway in the private subnet
This is incorrect. The NAT Gateway needs public connectivity, so it belongs in a public subnet with a route to an Internet Gateway.
Updating the wrong route table
The route that sends traffic to the NAT Gateway belongs in the route table associated with the private subnet. The public subnet’s route table should continue to route internet-bound traffic to the Internet Gateway.
Assuming a public IP on the private instance is necessary
The private instance does not need a public IPv4 address when it uses a NAT Gateway for outbound access. Giving it a public address would undermine the private-subnet design.
Confusing NAT Gateway with an Internet Gateway
An Internet Gateway enables direct internet connectivity for resources in public subnets when their network interfaces have appropriate public addressing. A NAT Gateway provides translated, outbound-only access for private resources.
Expecting inbound connections through the NAT Gateway
A NAT Gateway does not allow arbitrary internet hosts to initiate connections to private EC2 instances. For inbound application traffic, use an appropriate public load balancer, reverse proxy, or other controlled entry point.
Forgetting Availability Zone resilience
A single NAT Gateway can become a cross-AZ dependency or single point of failure for private subnets in other Availability Zones. Production architectures commonly use one NAT Gateway per AZ and local routing.
Leaving lab resources running
NAT Gateways and Elastic IP addresses can create ongoing charges. Delete the NAT Gateway first, then release its Elastic IP after the association is removed.
Real-World Engineer Notes
- NAT Gateway is managed by AWS, so there is no proxy instance to patch or scale. However, it still has capacity, pricing, and Availability Zone design implications.
- Route private subnets to the NAT Gateway in the same AZ whenever possible. Routing across AZs can add data-transfer cost and creates dependency on another AZ.
- Use VPC endpoints for high-volume access to AWS services such as Amazon S3 or DynamoDB where supported. Gateway endpoints can avoid NAT processing for those services, while interface endpoints use AWS PrivateLink and have their own costs and configuration requirements.
- Check both security groups and network ACLs when troubleshooting. A private instance may have a correct default route but still fail because egress rules, ephemeral return ports, DNS, or the destination service is blocked.
- DNS resolution must be functioning if the private instance accesses destinations by hostname. VPC DNS attributes and the instance resolver configuration are part of the end-to-end path.
- For administrative access, AWS Systems Manager Session Manager can often eliminate the need for an internet-facing bastion host, provided the instance has the required IAM role and connectivity to Systems Manager endpoints.
- NAT Gateway does not replace egress filtering or inspection. If the requirement includes domain filtering, malware inspection, or centralized policy enforcement, add an appropriate firewall or proxy architecture.
Quick Reference Summary
Public subnet:
0.0.0.0/0 -> Internet Gateway
NAT Gateway + Elastic IP
Private subnet:
VPC CIDR -> local
0.0.0.0/0 -> NAT Gateway
Result:
Private instances can initiate outbound internet connections.
Internet hosts cannot directly initiate connections to those instances through NAT.
Remember the exam phrase: the NAT Gateway is in the public subnet, but the route to it is in the private subnet’s route table.
Flashcards
- Where is a NAT Gateway deployed?
In a public subnet with a route to an Internet Gateway.
- Which route table points to the NAT Gateway?
The route table associated with the private subnet.
- What default route is commonly used for internet-bound traffic?
0.0.0.0/0.
- What address does a public NAT Gateway require?
An Elastic IP address.
- Can a private EC2 instance use a NAT Gateway without a public IP?
Yes. The NAT Gateway performs the public address translation.
- Does a NAT Gateway permit unsolicited inbound traffic?
No. It supports return traffic for connections initiated from the private side.
- What is the role of the Internet Gateway in this design?
It provides internet connectivity to the public subnet containing the NAT Gateway.
- What is the difference between a bastion host and a NAT Gateway?
A bastion provides administrative access; a NAT Gateway provides outbound internet access.
- How can NAT Gateway single-AZ dependency be reduced?
Deploy one NAT Gateway per AZ and route each private subnet to its local NAT Gateway.
- What should be done with a NAT Gateway’s Elastic IP during cleanup?
Delete the NAT Gateway, wait for disassociation, then release the Elastic IP.
- Why might a private instance still fail to reach the internet after adding a NAT route?
Possible causes include an unavailable NAT Gateway, incorrect subnet route association, blocked security group or network ACL rules, missing DNS resolution, or an incorrect public-subnet route.
- What alternative can reduce NAT usage for supported AWS services?
VPC endpoints, such as gateway endpoints for Amazon S3 and DynamoDB or interface endpoints using AWS PrivateLink.
Practice Questions
Question 1
An EC2 instance in a private subnet must download security updates from the public internet. The instance must not accept inbound connections from the internet. Which design meets the requirement?
A. Add an Internet Gateway route to the private subnet and assign the instance a public IP.
B. Deploy a NAT Gateway in a public subnet and add 0.0.0.0/0 to the private route table with the NAT Gateway as the target.
C. Deploy an Internet Gateway in the private subnet and add a route to the bastion host.
D. Deploy a NAT Gateway in the private subnet and add a route to the Internet Gateway.
Correct answer: B
A NAT Gateway in a public subnet provides outbound translation for the private instance. The private route table points to the NAT Gateway, while the public subnet routes through the Internet Gateway.
Question 2
A company has private application subnets in three Availability Zones. The application must continue to access external APIs if one Availability Zone fails. Which architecture provides the best resilience?
A. One NAT Gateway in any public subnet, used by all private subnets
B. One NAT Gateway in a private subnet in each Availability Zone
C. One NAT Gateway in a public subnet in each Availability Zone, with each private subnet routed to the local NAT Gateway
D. One Internet Gateway per private subnet
Correct answer: C
NAT Gateways must be in public subnets. Deploying one per AZ and using local routing avoids dependence on a NAT Gateway or cross-AZ path in another AZ.
Question 3
An engineer created a NAT Gateway and configured the private route table correctly, but the private EC2 instance cannot access a public hostname. Which item should be checked first as part of the network path?
A. Whether the NAT Gateway is in a public subnet with a route to an Internet Gateway
B. Whether the private instance has an Elastic IP
C. Whether the bastion host has an additional network interface
D. Whether the private route table has an Internet Gateway target instead of a NAT target
Correct answer: A
The NAT Gateway itself requires public subnet connectivity through an Internet Gateway. The private instance does not need its own Elastic IP, and the private route table should target the NAT Gateway, not the Internet Gateway.
Question 4
A workload in a private subnet frequently accesses Amazon S3. The organization wants to reduce NAT Gateway data-processing costs while keeping the workload private. Which option should be considered?
A. Assign public IP addresses to all instances
B. Add a VPC gateway endpoint for Amazon S3 and configure the relevant route policies
C. Replace the NAT Gateway with a bastion host
D. Route S3 traffic through an Internet Gateway directly from the private subnet
Correct answer: B
An Amazon S3 gateway endpoint can provide private VPC access to S3 without sending the traffic through a NAT Gateway. Public addressing and direct Internet Gateway routing would not preserve the intended private-subnet design.
Question 5
A temporary NAT Gateway was deleted, but the associated Elastic IP cannot yet be released. What is the most likely explanation?
A. Elastic IPs can never be released after NAT Gateway use
B. The NAT Gateway deletion has not fully completed and the address is still associated
C. The private route table must be deleted first
D. The Elastic IP must be converted to a public IPv4 address
Correct answer: B
The Elastic IP remains associated until the NAT Gateway is fully deleted. After deletion completes, refresh the resource state and release the Elastic IP.