What's changed: In-scope coverage: added service mesh/discovery/device VPN (App Mesh/Cloud Map/Client VPN)
1.2Subnet and Routing Design
Understand traffic paths—public/private subnets, route tables, internet gateway, and NAT gateway. The route table decides whether a subnet is public.
Whether a subnet is "public" or "private" is decided by its route table—specifically where the route to the internet points.
1.2.1Public vs private
- Public subnet: route 0.0.0.0/0 → IGW (internet gateway). Host ALB and NAT gateway here.
- Private subnet: route 0.0.0.0/0 → NAT gateway. Egress only; no inbound from the internet.
- NAT gateway: relays egress for private subnets. The NAT itself sits in a public subnet.
- One subnet = one route table: each subnet has one associated route table (the main one if not explicit).
Common on ANS-C01: a route to IGW makes a subnet public, private egress uses a NAT gateway (the NAT sits in a public subnet), and NAT does not allow inbound. You cannot give a private subnet direct internet inbound via an IGW.
For IPv6 egress-only traffic, use an "egress-only internet gateway," not NAT. NAT gateways are for IPv4.
ANS-C01 routing design precisely probes "route table evaluation and gateway roles." Routes are chosen by longest-prefix match, preferring more specific routes. A subnet associates with one route table, defaulting to the main route table if not explicit. An internet gateway (IGW) is a horizontally scaled, redundant component attached to the VPC, enabling bidirectional internet for resources with public IPs/EIPs. A NAT gateway is managed and per-AZ (place one per AZ for HA), egress-only with no inbound initiation, for IPv4 (preferred over a self-managed NAT instance). IPv6 egress-only uses an Egress-Only IGW. For traffic within the VPC, VPC endpoints (gateway type = S3/DynamoDB, added to route tables via a prefix list / interface type = ENI, PrivateLink, resolved by DNS) reach AWS services without the internet. Route targets can be IGW/NAT/peering connection/TGW attachment/VPC endpoint/Gateway Load Balancer endpoint (inline inspection), and middlebox routing (edge association) can divert IGW-inbound traffic to an inspection appliance. The key is to nail "route to IGW = public," "NAT is egress-only, one per AZ," "longest-prefix match," and "AWS services via VPC endpoints."
| Gateway/route | Role | Key point |
|---|---|---|
| IGW | Bidirectional internet | Public IP/EIP; redundant; scales |
| NAT gateway | IPv4 egress-only | One per AZ; no inbound initiation |
| Egress-Only IGW | IPv6 egress-only | NAT-equivalent for IPv6 |
| VPC endpoint | Private to AWS services | Gateway (S3/DDB)/interface type |
Scenario: Hundreds of instances in private subnets need OS patches and S3 access—balance availability with cost/performance. → For general egress, place a NAT gateway per AZ (survives AZ failure, reduces cross-AZ transfer cost) and point each subnet’s route to the same-AZ NAT. For S3, use a gateway VPC endpoint (free; prefix list in the route table) to avoid the internet and NAT, improving transfer cost and security.
FAQ: Is one NAT gateway enough? It works functionally, but a single-AZ NAT halts egress for other AZs if that AZ fails, and traffic from other AZs incurs cross-AZ data transfer charges. For HA and cost, the best practice is one NAT gateway per AZ, routing each subnet to the NAT in its own AZ.
Exam trap: Using a NAT gateway to give private-subnet instances "internet inbound" is wrong—NAT is egress-only and cannot initiate inbound. For internet inbound, use a public subnet + IGW (or via an ALB). Also, placing the NAT in a private subnet is wrong—the NAT goes in a public subnet with a route to the IGW.
1.2.2Section summary
- Public-ness = does the route point to IGW
- Private egress = NAT gateway (placed in public subnet)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. What is the decisive condition that makes a subnet a "public subnet"?
Q2. A private-subnet instance must fetch OS patches from the internet (egress) but accept no inbound. What?
Q3. In which subnet do you place a NAT gateway?