How Do Private Subnet EC2 Instances Get Internet Access via NAT?
A CloudOps engineer has created a VPC that contains a public subnet and a private subnet. Amazon EC2 instances that were launched in the private subnet cannot access the internet. The default network ACL is active on all subnets in the VPC, and all security groups allow all outbound traffic. Which solution will provide the EC2 instances in the private subnet with access to the internet?
Community Insight
The exam tests the two-part NAT pattern — gateway in a public subnet, default route in the private subnet's route table — and traps you into pairing the right gateway location with the wrong route table.
Private-subnet EC2 instances reach the internet only when a NAT gateway sits in the public subnet and the private subnet's route table points 0.0.0.0/0 at it. This page confirms option A as the working design and explains why NAT gateway placement and route-target mistakes break connectivity.
Learners often pick D, correctly reasoning that the private subnet needs the route but wrongly placing the NAT gateway inside that same private subnet, even though a NAT gateway requires a public subnet with an internet gateway to function.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
A NAT gateway performs source network address translation for traffic leaving a private subnet, but it must itself reside in a public subnet that has a route to an internet gateway, otherwise the translated traffic has no path out. Option A satisfies both halves of the pattern: the gateway is created in the public subnet, and the private subnet's route table gets a 0.0.0.0/0 (or specific CIDR) entry targeting that NAT gateway. Because the question states that the default network ACL is active and security groups allow all outbound traffic, no filtering change is required — only the routing and gateway placement are missing. Instances in the private subnet then send internet-bound packets to the NAT gateway's elastic IP, and return traffic flows back through the same NAT mapping.Why the Other Options Are Wrong
Option B puts the NAT gateway in the correct public subnet but adds the route to the public subnet's route table, which does nothing for the private instances — the public subnet already reaches the internet through the internet gateway, and the private subnet's route table remains without a default route. Option C inverts the design entirely: a NAT gateway inside the private subnet has no path to the internet gateway, and routing the public subnet through it would be pointless because public instances should use the internet gateway directly. Option D places the NAT gateway in the private subnet, the same fatal flaw as C; a NAT gateway needs to live in a public subnet, so the routing target either cannot be created or cannot forward traffic. Only A fixes placement and routing together.Community Comment Notes
Bad_Mat recorded answer A and echoed the exact fix, noting that you should "Create a NAT gateway in the public subnet" and then route from the private subnet to it. That mirrors the canonical AWS pattern of a public-subnet NAT gateway plus a private route table default route. There is no dissent in the thread, and the reasoning holds independently of the vote count because it follows directly from how a NAT gateway is defined in the VPC user guide. The absence of NAT-gateway discussion in the other options is itself the tell that they misplace either the gateway or the route.Official Reference
Exam Strategy
For any NAT question, split it into two checks: where the gateway lives (must be a public subnet) and which route table carries the 0.0.0.0/0 entry (must be the private subnet's). Eliminate options that fail either check before reading the remaining wording.
Frequently Asked Questions
Why can't the NAT gateway be created in the private subnet?
A NAT gateway must sit in a public subnet with a route to an internet gateway; in a private subnet it has no outbound path and cannot translate traffic.
Does the public subnet's route table need a route to the NAT gateway?
No. Public instances use the internet gateway directly; only the private subnet's route table needs 0.0.0.0/0 pointing at the NAT gateway.
Related Analysis
Practice All SOA-C03 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SOA-C03 Practice Test →