Question

A company runs a fleet of EC2 instances in a private subnet of a dual-stack VPC. The instances have both IPv4 and IPv6 addresses. For IPv4, they already reach the internet through a NAT gateway for software updates. The security team now requires that these instances be able to initiate outbound IPv6 connections to the internet (for example, to fetch packages from IPv6-enabled repositories) but must NOT be reachable from the internet over IPv6. Which configuration meets this requirement?

Accepted Answer

Add an egress-only internet gateway to the VPC and add a route for ::/0 pointing to it in the private subnet's route table.

Answer

Route IPv6 traffic through the existing NAT gateway by adding a ::/0 route pointing to the NAT gateway.

Answer

Attach a standard internet gateway and add a ::/0 route to it, then use security groups to block inbound IPv6.

Answer

Assign the instances IPv6 addresses from a BYOIP pool and rely on the default VPC route table to provide outbound-only access.