How do IPv6-only EC2 instances get outbound-only internet access?

SOA-C03 By islever Editorial Last updated Oct 20, 2026

Implement and optimize networking features and connectivity.

Short answer

C Attach an egress-only internet gateway and point the subnets' route table ::/0 IPv6 traffic to it, giving outbound-only internet access.

Question

A company wants to use only IPv6 for all its Amazon EC2 instances. The EC2 instances must not be accessible from the internet, but the EC2 instances must be able to access the internet. The company creates a dual-stack VPC and IPv6-only subnets.
How should a CloudOps engineer configure the VPC to meet these requirements?

Create and attach a NAT gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the NAT gateway. Attach the custom route table to the IPv6-only subnets.
Create and attach an internet gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the internet gateway. Attach the custom route table to the IPv6-only subnets.
Create and attach an egress-only internet gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the egress-only internet gateway. Attach the custom route table to the IPv6-only subnets. Correct Answer
Create and attach an internet gateway and a NAT gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the internet gateway and all IPv4 traffic to the NAT gateway. Attach the custom route table to the IPv6-only subnets.

Key Takeaways

It tests whether you know that IPv6 egress control is handled by an egress-only internet gateway rather than a NAT gateway or a plain internet gateway, and the trap is assuming NAT gateway behavior carries over to IPv6.

IPv6-only EC2 instances that must reach the internet without being reachable from it require an egress-only internet gateway plus a route table entry for ::/0. This page confirms why that outbound-only design makes option C the correct configuration for the dual-stack VPC and its IPv6-only subnets.

Common mistake: Most learners pick option A and route ::/0 to a NAT gateway, but NAT gateways translate IPv4 only and cannot provide outbound-only IPv6 connectivity.

Expert Analysis

Why the Answer Is Correct

An egress-only internet gateway is the AWS construct built specifically for IPv6: it permits instances in a VPC to initiate outbound IPv6 traffic to the internet while blocking the internet from initiating connections inbound to those instances. Because the instances live in IPv6-only subnets, the route table for those subnets needs a::/0 entry whose target is the egress-only internet gateway, and that custom route table must be associated with the IPv6-only subnets. That combination satisfies both stated requirements at once: internet access works, and inbound internet reachability does not. Option C describes exactly this gateway, route, and association sequence.

Why the Other Options Are Wrong

Option A fails because a NAT gateway performs source NAT for IPv4 traffic only; it has no IPv6 translation capability, so a::/0 route pointing at a NAT gateway cannot deliver working IPv6 egress. Option B would technically give the instances internet access, but an internet gateway route for::/0 also makes them bidirectional and therefore reachable from the internet, violating the isolation requirement. Option D mixes both gateways and still sends IPv6 traffic to the internet gateway, so it reintroduces the inbound exposure while adding a NAT gateway that is irrelevant to an IPv6-only workload.

Community Comment Notes

The only comment on this item, from Bad_Mat, selects the egress-only internet gateway and notes the item dates from 2021, which matches how AWS has long recommended handling IPv6 egress. That agreement is consistent with the vendor's documented model, where the egress-only internet gateway is the IPv6 analogue of a NAT gateway. No commenter defends the NAT gateway or dual-gateway answers, so there is no credible counter-argument in the discussion thread.

Official Reference

https://docs.aws.amazon.com/vpc/latest/userguide/egress-only-internet-gateway.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Map the requirement keywords to the building block before reading the options: "IPv6" plus "no inbound from internet" equals egress-only internet gateway, while IPv4 plus the same wording equals NAT gateway. Then verify the option also includes the ::/0 route and the subnet route-table association, since a correct gateway with the wrong route target is still wrong.

Frequently Asked Questions

Why can't a NAT gateway provide internet access for IPv6-only EC2 instances?

A NAT gateway translates IPv4 addresses only. IPv6 egress uses an egress-only internet gateway, which allows outbound connections and their return traffic but blocks inbound initiation.

What route entry must the custom route table contain for the IPv6-only subnets?

Add a ::/0 destination targeting the egress-only internet gateway, then associate that route table with the IPv6-only subnets so all IPv6 traffic follows it.

More SOA-C03 FAQ →

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

Bad_Mat 👍 1 Answered C

C. Create and attach an egress-only internet gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the egress-only internet gateway. Attach the custom route table to the IPv6-only subnets This question from 2021

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All SOA-C03 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SOA-C03 Practice Test →

← Back to SOA-C03 Study Guide