How do IPv6-only EC2 instances get outbound-only internet access?

Why the Answer Is Correct

An egress-only internet gateway is the AWS construct built specifically for IPv6: it permits instances in a VPC to initiate outbound IPv6 traffic to the internet while blocking the internet from initiating connections inbound to those instances. Because the instances live in IPv6-only subnets, the route table for those subnets needs a::/0 entry whose target is the egress-only internet gateway, and that custom route table must be associated with the IPv6-only subnets. That combination satisfies both stated requirements at once: internet access works, and inbound internet reachability does not. Option C describes exactly this gateway, route, and association sequence.

Why the Other Options Are Wrong

Option A fails because a NAT gateway performs source NAT for IPv4 traffic only; it has no IPv6 translation capability, so a::/0 route pointing at a NAT gateway cannot deliver working IPv6 egress. Option B would technically give the instances internet access, but an internet gateway route for::/0 also makes them bidirectional and therefore reachable from the internet, violating the isolation requirement. Option D mixes both gateways and still sends IPv6 traffic to the internet gateway, so it reintroduces the inbound exposure while adding a NAT gateway that is irrelevant to an IPv6-only workload.

Community Comment Notes

The only comment on this item, from Bad_Mat, selects the egress-only internet gateway and notes the item dates from 2021, which matches how AWS has long recommended handling IPv6 egress. That agreement is consistent with the vendor's documented model, where the egress-only internet gateway is the IPv6 analogue of a NAT gateway. No commenter defends the NAT gateway or dual-gateway answers, so there is no credible counter-argument in the discussion thread.