Question

A retail company is migrating its public-facing web tier to dual-stack (IPv4 and IPv6) to support new mobile clients on IPv6-only carrier networks. The architecture uses an internet-facing Application Load Balancer in front of EC2 targets in private subnets. The security team requires that IPv6 clients can reach the ALB, while EC2 instances in private subnets must never be directly reachable from the internet over either protocol, yet must still perform outbound software updates over IPv6. Which design meets all requirements?

Accepted Answer

Enable dual-stack on the ALB in public subnets, assign IPv6 CIDRs to both public and private subnets, add a route to an Internet Gateway in public subnets, and add a route to an egress-only Internet Gateway for the private subnets' IPv6 default route.

Answer

Enable dual-stack on the ALB, assign IPv6 to public subnets only, and route the private subnets' IPv6 traffic through a NAT gateway for both inbound and outbound access.

Answer

Configure the ALB as IPv6-only, assign IPv6 CIDRs to all subnets, and add an Internet Gateway route in the private subnets so instances can reach update servers.

Answer

Enable dual-stack on the ALB, assign IPv6 to private subnets, and rely on security group rules alone to block inbound IPv6 while allowing the default IGW route in the private subnets.