Using IPv6 in an Amazon VPC: Addressing, Routing, and Egress-Only Internet Gateways – SAP-C02 Study Guide | AWS Systems Architect Professional

Study guide

Technical reference and lesson notes

Purpose of This Lesson

IPv4 address exhaustion has driven the adoption of IPv6. In Amazon VPC, IPv6 provides a very large address space and changes how internet connectivity is designed because IPv6 addresses are globally routable and do not use NAT in the same way as IPv4.

For the SAP-C02 exam, the key decisions are how to allocate IPv6 ranges, how subnet and route table configuration differs from IPv4, and when to use an egress-only internet gateway.

Key Concepts

IPv4 limitations and NAT

IPv4 uses 32-bit addresses, providing approximately 4.3 billion possible addresses. Private IPv4 addressing combined with Network Address Translation (NAT) allows many internal resources to share a smaller number of public IPv4 addresses.

NAT helps conserve IPv4 space, but it does not eliminate address exhaustion. It also introduces an additional translation layer and does not provide a general solution for assigning globally reachable addresses to large numbers of devices.

IPv6 addressing format

IPv6 uses 128-bit addresses written in hexadecimal and separated by colons. An IPv6 address contains a network prefix and an interface or node portion, similar conceptually to the network and host portions of IPv4.

The IPv6 address space is vastly larger than IPv4, making address exhaustion impractical for normal deployment planning.

IPv6 CIDR allocation in a VPC

When IPv6 is enabled for an Amazon VPC, AWS assigns an IPv6 CIDR block with a /56 prefix. Subnets receive IPv6 CIDR blocks with a /64 prefix.

A /64 subnet contains approximately 18.4 quintillion addresses. The subnet identifier is represented by a hexadecimal segment, allowing up to 256 /64 subnet ranges within the VPC’s /56 allocation.

IPv4 and IPv6 addressing can coexist in the same VPC. This is commonly called a dual-stack design. Resources may have both private IPv4 and IPv6 addresses, and routing must be configured for each protocol independently.

IPv6 addresses are globally routable

IPv6 addresses in a VPC are globally unique and publicly routable. Unlike private IPv4 addresses, they are not translated through NAT to reach the internet.

This does not mean that every IPv6-enabled resource is automatically reachable from the internet. Internet reachability still depends on all of the following:

A route to an internet gateway or egress-only internet gateway, as appropriate.
Security group rules allowing the traffic.
Network ACL rules allowing the traffic.
The resource and subnet having the required IPv6 configuration.
Any host-level firewall allowing the traffic.

IPv6 route tables

IPv6 routes use IPv6 CIDR notation. Two important entries are:

VPC-IPv6-CIDR::/56 or the applicable VPC IPv6 range, routed locally within the VPC.
::/0, which represents all IPv6 destinations and is equivalent to IPv4 0.0.0.0/0.

A route such as ::/0 can target an internet gateway for general internet connectivity or an egress-only internet gateway for outbound-only IPv6 access.

Egress-only internet gateway

An egress-only internet gateway is a VPC component for outbound-only IPv6 communication. It allows resources to initiate connections to external IPv6 destinations while preventing externally initiated IPv6 connections from reaching those resources through the gateway.

Use an egress-only internet gateway when instances or other IPv6-enabled resources need outbound internet access but should not be directly reachable from the internet. It is the IPv6 counterpart to the outbound-only intent commonly associated with NAT gateways, although the mechanisms differ:

NAT gateways translate private IPv4 addresses and support outbound IPv4 connectivity.
Egress-only internet gateways do not perform address translation; they provide stateful outbound-only connectivity for IPv6.

Architecture Decision Guide

Requirement	Typical IPv6 design	Important consideration
Publicly reachable IPv6 application	Route subnet IPv6 traffic to an internet gateway	Control access with security groups, network ACLs, and host firewalls
Outbound-only IPv6 access	Route `::/0` to an egress-only internet gateway	Return traffic for connections initiated internally is allowed; unsolicited inbound traffic is blocked
IPv4 and IPv6 clients or dependencies	Use a dual-stack VPC and dual-stack subnets/resources where supported	Configure IPv4 and IPv6 routes and security rules separately
Internal VPC IPv6 communication	Use the VPC IPv6 CIDR route with local target	IPv6 traffic does not require NAT for communication within the VPC
Outbound-only IPv4 access	Use private IPv4 addressing with a NAT gateway	An egress-only internet gateway is for IPv6, not IPv4

Exam-Relevant Takeaways

IPv4 addresses are 32 bits; IPv6 addresses are 128 bits.
IPv6 addresses are written in hexadecimal colon notation rather than IPv4 dotted-decimal notation.
AWS assigns a /56 IPv6 CIDR block to a VPC.
VPC subnets use /64 IPv6 CIDR blocks.
A /64 IPv6 subnet provides an extremely large address space and is not sized like a typical IPv4 subnet.
::/0 is the IPv6 equivalent of 0.0.0.0/0.
IPv6 traffic does not use NAT for internet access.
An internet gateway supports general IPv6 internet connectivity, subject to routing and access controls.
An egress-only internet gateway allows outbound-only IPv6 communication and blocks unsolicited inbound connections.
IPv4 and IPv6 routing are separate. A working IPv4 route does not automatically provide IPv6 connectivity.
IPv6 reachability is still controlled by route tables, security groups, network ACLs, and host-level controls.

Common Exam Traps

Choosing a NAT gateway for IPv6: NAT gateways are used for IPv4 translation. For outbound-only IPv6, use an egress-only internet gateway.
Assuming all IPv6 addresses are private: IPv6 addresses in a VPC are globally routable. Security controls, not address translation, provide protection.
Forgetting the IPv6 default route: IPv4 0.0.0.0/0 and IPv6 ::/0 are separate routes. Both are needed in a dual-stack design.
Assuming an internet gateway alone makes a resource reachable: The route table, security group, network ACL, and host firewall must also permit the traffic.
Using an IPv4 subnet size for IPv6: AWS IPv6 subnets use /64 ranges. IPv6 subnet sizing is not normally used to conserve addresses.
Confusing outbound-only with no return traffic: An egress-only internet gateway allows return traffic for connections initiated by internal resources. It blocks unsolicited inbound connections.
Treating IPv6 as a replacement that removes IPv4 requirements: Many applications and AWS services still require or support IPv4. Dual-stack operation may be necessary during migration.

Real-World Engineer Notes

Design IPv6 security rules explicitly. A security group rule for IPv4 does not automatically allow the corresponding IPv6 traffic.
Review both route tables and network ACLs when troubleshooting dual-stack connectivity. It is common for IPv4 to work while IPv6 fails because only the IPv4 path was configured.
Avoid relying on obscurity or the absence of NAT as a security boundary. Globally routable IPv6 addresses require deliberate least-privilege controls.
Use an egress-only internet gateway for resources such as outbound update clients, telemetry agents, or IPv6-enabled workloads that should not accept unsolicited internet connections.
Confirm that the selected AWS service, load balancer, endpoint, and operating system configuration support IPv6 before making IPv6 mandatory.

Quick Reference Summary

IPv4: 32-bit, dotted decimal, approximately 4.3 billion addresses.
IPv6: 128-bit, hexadecimal, extremely large address space.
VPC IPv6 range: AWS-assigned /56.
Subnet IPv6 range: /64.
IPv6 default route: ::/0.
General internet access: Internet gateway.
Outbound-only IPv6 access: Egress-only internet gateway.
NAT for IPv6: Not used for normal VPC internet connectivity.
Dual stack: IPv4 and IPv6 operate concurrently and require separate addressing, routes, and security rules.

Flashcards

Q: How large is an IPv6 address?

A: 128 bits.

Q: What notation is used for IPv6 addresses?

A: Hexadecimal groups separated by colons.

Q: What IPv6 CIDR prefix does AWS assign to a VPC?

A: /56.

Q: What IPv6 CIDR prefix is used for VPC subnets?

A: /64.

Q: What does ::/0 represent?

A: All IPv6 destinations; it is the IPv6 equivalent of 0.0.0.0/0.

Q: Are IPv6 addresses in a VPC globally routable?

A: Yes. They are globally unique and routable, subject to routing and security controls.

Q: Is NAT required for outbound IPv6 internet access?

A: No. IPv6 does not require NAT for this purpose.

Q: What does an egress-only internet gateway provide?

A: Outbound-only IPv6 internet connectivity while preventing unsolicited inbound connections.

Q: What is the difference between an internet gateway and an egress-only internet gateway for IPv6?

A: An internet gateway supports general bidirectional internet connectivity when permitted; an egress-only internet gateway is designed for outbound-initiated IPv6 connections only.

Q: Does an IPv4 route automatically enable IPv6 connectivity?

A: No. IPv4 and IPv6 require separate routes and security rules.

Practice Questions

Question 1

A company runs IPv6-enabled application servers in private application subnets. The servers must retrieve software updates from the public IPv6 internet, but unsolicited inbound IPv6 connections must be blocked. Which design best meets the requirement?

A. Add an IPv4 NAT gateway and route IPv6 traffic to it
B. Add an internet gateway and allow all inbound IPv6 traffic in the security group
C. Add an egress-only internet gateway and route ::/0 to it
D. Add a VPC peering connection and route ::/0 through the peering connection

Correct answer: C

An egress-only internet gateway is designed for outbound-only IPv6 connectivity. A NAT gateway is for IPv4 translation, and the other options do not provide the required controlled IPv6 internet path.

Question 2

An architect is configuring a dual-stack subnet in a VPC. IPv4 clients can reach an internet-facing service, but IPv6 clients cannot. The subnet already has an IPv4 default route to an internet gateway. What is the most likely missing configuration?

A. A route for ::/0 to an internet gateway
B. A NAT gateway with an IPv6 private address
C. An additional IPv4 local route
D. An egress-only internet gateway is always required for inbound IPv6 traffic

Correct answer: A

IPv4 and IPv6 routing are independent. The subnet needs an IPv6 default route, such as ::/0 to an internet gateway, along with appropriate IPv6 security group and network ACL rules.

Question 3

A security review identifies EC2 instances with globally routable IPv6 addresses. The instances should not accept unsolicited internet connections but must maintain outbound connections to external IPv6 services. Which control provides the correct network architecture?

A. Remove all IPv6 addresses from the instances
B. Route IPv6 traffic through an egress-only internet gateway and restrict security group ingress
C. Use a NAT gateway to hide the IPv6 addresses
D. Route all IPv6 traffic through the VPC local target

Correct answer: B

An egress-only internet gateway supports outbound-initiated IPv6 connections and blocks unsolicited inbound connections. Security groups should still enforce least-privilege access.

Question 4

A solutions architect must allocate IPv6 CIDR blocks for a new VPC and its subnets. Which allocation is consistent with standard Amazon VPC IPv6 addressing?

A. VPC /64, subnets /80
B. VPC /48, subnets /56
C. VPC /56, subnets /64
D. VPC /32, subnets /48

Correct answer: C

AWS assigns a /56 IPv6 CIDR block to a VPC, and VPC subnets use /64 IPv6 CIDR blocks.