An IPv6-enabled EC2 instance in a private subnet must call the internet.
Do not allow connections initiated from the internet to the instance.
Which configuration is most appropriate?
Use an egress-only internet gateway and an IPv6 route from the private subnet.
Detailed explanation
Gateway endpoints are for supported AWS services such as S3, not arbitrary internet destinations.
Gateway endpoints are for supported AWS services such as S3, not arbitrary internet destinations.
An AAAA record does not create an outbound route or an inbound access boundary.
An AAAA record does not create an outbound route or an inbound access boundary.
NAT Gateway is primarily an IPv4 translation service and is not the IPv6 egress-only gateway.
NAT Gateway is primarily an IPv4 translation service and is not the IPv6 egress-only gateway.
This gateway permits outbound IPv6 connections while preventing internet-initiated inbound connections.
This gateway permits outbound IPv6 connections while preventing internet-initiated inbound connections.
Check official documentation
Compare the following points with the official documentation.
VPC egress-only internet gatewaysの公式説明を確認する。
What to confirm
NAT GatewayとIPv6 egress-only internet gatewayを区別できる。
Key points
- Egress-only internet gateway
- IPv6
- Outbound path
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
IPv4 and IPv6 egress
NAT Gateway translates IPv4; an egress-only internet gateway controls IPv6 egress.
Endpoint scope
An S3 gateway endpoint is service-specific and is not a general internet route.