Question

A SysOps administrator deploys EC2 instances in a private subnet that must download OS patches from the internet but must not accept any inbound connections initiated from the internet. The private subnet's route table currently only contains the local VPC route. The VPC already has an internet gateway attached, and there is a public subnet with a route to the internet gateway. Instances in the private subnet cannot reach the internet. What is the correct way to enable outbound-only internet access for these private instances?

Accepted Answer

Deploy a NAT gateway in the public subnet and add a route in the private subnet's route table for 0.0.0.0/0 pointing to the NAT gateway.

Answer

Add a route in the private subnet's route table for 0.0.0.0/0 pointing to the internet gateway and assign Elastic IPs to the instances.

Answer

Deploy a NAT gateway in the private subnet and add a route in the private subnet's route table for 0.0.0.0/0 pointing to the NAT gateway.

Answer

Create a VPC peering connection to a shared services VPC that has internet access and add a route to that peering connection.