Question

A company runs a fleet of EC2 application servers in a private subnet of a VPC. The servers must download OS security patches and application updates from vendor repositories on the public internet, but the security team requires that no unsolicited inbound connection from the internet can ever reach these instances. The VPC currently has only public subnets with an internet gateway. Which change best meets these requirements?

Accepted Answer

Move the instances to a private subnet and route their default (0.0.0.0/0) traffic through a NAT gateway placed in a public subnet.

Answer

Keep the instances in the public subnet, assign Elastic IPs, and use a network ACL to deny all inbound traffic on ephemeral ports.

Answer

Move the instances to a private subnet and route their default traffic directly to the internet gateway using a route table.

Answer

Attach an egress-only internet gateway to the VPC and route the private subnet's IPv4 traffic through it.