How Do Private Subnet EC2 Instances Get Internet Access via NAT?

Why the Answer Is Correct

A NAT gateway performs source network address translation for traffic leaving a private subnet, but it must itself reside in a public subnet that has a route to an internet gateway, otherwise the translated traffic has no path out. Option A satisfies both halves of the pattern: the gateway is created in the public subnet, and the private subnet's route table gets a 0.0.0.0/0 (or specific CIDR) entry targeting that NAT gateway. Because the question states that the default network ACL is active and security groups allow all outbound traffic, no filtering change is required — only the routing and gateway placement are missing. Instances in the private subnet then send internet-bound packets to the NAT gateway's elastic IP, and return traffic flows back through the same NAT mapping.

Why the Other Options Are Wrong

Option B puts the NAT gateway in the correct public subnet but adds the route to the public subnet's route table, which does nothing for the private instances — the public subnet already reaches the internet through the internet gateway, and the private subnet's route table remains without a default route. Option C inverts the design entirely: a NAT gateway inside the private subnet has no path to the internet gateway, and routing the public subnet through it would be pointless because public instances should use the internet gateway directly. Option D places the NAT gateway in the private subnet, the same fatal flaw as C; a NAT gateway needs to live in a public subnet, so the routing target either cannot be created or cannot forward traffic. Only A fixes placement and routing together.

Community Comment Notes

Bad_Mat recorded answer A and echoed the exact fix, noting that you should "Create a NAT gateway in the public subnet" and then route from the private subnet to it. That mirrors the canonical AWS pattern of a public-subnet NAT gateway plus a private route table default route. There is no dissent in the thread, and the reasoning holds independently of the vote count because it follows directly from how a NAT gateway is defined in the VPC user guide. The absence of NAT-gateway discussion in the other options is itself the tell that they misplace either the gateway or the route.