How to Configure NAT Gateways for Internet Access from Private Subnets

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

C Create public NAT gateways in public subnets in the same VPCs as the EC2 instances to enable internet connectivity.

Question

A company wants to use NAT gateways in its AWS environment. The company's Amazon EC2 instances in private subnets must be able to connect to the public internet through the NAT gateways. Which solution will meet these requirements?
  1. Create public NAT gateways in the same private subnets as the EC2 instances.
  2. Create private NAT gateways in the same private subnets as the EC2 instances.
  3. Create public NAT gateways in public subnets in the same VPCs as the EC2 instances. Correct Answer
  4. Create private NAT gateways in public subnets in the same VPCs as the EC2 instances.

Key Takeaways

This question tests the difference between public and private NAT gateways and their required subnet placements, trapping those who place a public NAT gateway in a private subnet or use a private NAT gateway for internet access.

To allow EC2 instances in private subnets to access the public internet, a public NAT gateway must be deployed in a public subnet within the same VPC. This page establishes why placing the public NAT gateway in a public subnet is the only valid architecture for internet connectivity.

Common mistake: Choosing option A by assuming the public NAT gateway can reside in the same private subnet as the EC2 instances, ignoring the requirement that it must be in a public subnet to route to the internet gateway.

Expert Analysis

Why the Answer Is Correct

A public NAT gateway allows instances in private subnets to connect to the internet but prevents the internet from initiating connections with those instances. For the public NAT gateway to route traffic to the internet, it must reside in a public subnet that has a route to an internet gateway. Option C correctly specifies placing the public NAT gateway in a public subnet within the same VPC, enabling the necessary outbound internet connectivity.

Why the Other Options Are Wrong

Option A is incorrect because a public NAT gateway cannot be placed in a private subnet; it needs a route to an internet gateway, which only exists in public subnets. Options B and D involve private NAT gateways, which are used to route traffic to other VPCs or on-premises networks via transit gateways or virtual private gateways, not to the public internet.

Community Comment Notes

Commenters universally agree that a public NAT gateway in a public subnet is required for internet access. As anikolov noted, "Public NAT GW in Public Subnet to have access to internet", while mestule pointed out that a private NAT gateway is intended for connectivity to "other VPCs or your on-premises network" and cannot reach the internet on its own.

Official Reference

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Remember the golden rule of AWS NAT gateways: to reach the internet, use a public NAT gateway in a public subnet. Private NAT gateways only route to other private networks and cannot provide internet access.

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. anikolov 👍 16 Answered C
    Should be C: Public NAT GW in Public Subnet to have access to internet. Private NAT GW is used for VPC or on-prem
  2. mestule 👍 9 Answered C
    I think the correct is C, because D would require more than just private NAT gateway. Private – Instances in private subnets can connect to other VPCs or your on-premises network through a private NAT gateway. You can route traffic from the NAT gateway through a transit gateway or a virtual private gateway. You cannot associate an elastic IP address with a private NAT gateway. You can attach an internet gateway to a VPC with a private NAT gateway, but if you route traffic from the private NAT gateway to the internet gateway, the internet gateway drops the traffic. https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html
  3. Kezuko 👍 3 Answered C
    Public NAT Gateway in public subnets for the internet access https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html
  4. knben 👍 2 Answered C
    Public NAT GW in Public Subnet to have access to internet
  5. Andy_09 👍 2
    Looks correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide