Internet Gateway for public access in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Architecture

intermediate

Identify the correct Internet Gateway attachment

You have a Virtual Private Cloud (VPC) and want to allow public internet access to instances in a public subnet. Which option correctly attaches an Internet Gateway to the VPC?

A Attach the Internet Gateway to the VPC using its ID, then update the route table to direct 0.0.0.0/0 traffic to the Internet Gateway.

B Attach the Internet Gateway to the subnet directly, then update the subnet's route table to direct 0.0.0.0/0 traffic to the Internet Gateway.

C Attach the Internet Gateway to the VPC, but no need to update any route tables for public access.

D Attach the Internet Gateway to the VPC and create a NAT Gateway in the same subnet for public access.

💡 Hint

Remember, Internet Gateways attach to VPCs, not subnets. Public access requires routing traffic through the Internet Gateway.

Internet Gateways must be attached to the VPC. Then, the route table for the public subnet must have a route directing all internet-bound traffic (0.0.0.0/0) to the Internet Gateway. Attaching to subnets or skipping route updates will not enable internet access.

❓ security

intermediate

Security group configuration for public internet access

You have attached an Internet Gateway and updated the route table for a public subnet. What security group rule is required to allow inbound HTTP traffic from the internet to an EC2 instance?

A Allow inbound UDP traffic on port 80 from source 0.0.0.0/0.

B Allow inbound TCP traffic on port 22 from source 0.0.0.0/0.

C Allow outbound TCP traffic on port 80 to source 0.0.0.0/0.

D Allow inbound TCP traffic on port 80 from source 0.0.0.0/0.

💡 Hint

HTTP uses TCP port 80 and inbound traffic must be allowed from anywhere for public access.

To allow public HTTP access, the security group must allow inbound TCP traffic on port 80 from all IP addresses (0.0.0.0/0). Port 22 is for SSH, outbound rules do not control inbound access, and UDP is not used for HTTP.

❓ service_behavior

advanced

Effect of missing Internet Gateway on public subnet traffic

You have a subnet with a route table directing 0.0.0.0/0 traffic to an Internet Gateway, but the Internet Gateway is not attached to the VPC. What will happen when an instance in this subnet tries to access the internet?

A The instance will access the internet normally because the route table has the correct route.

B The instance will fail to reach the internet because the Internet Gateway is not attached to the VPC.

C The instance will access the internet only for outbound traffic but not receive inbound traffic.

D The instance will use the NAT Gateway automatically to reach the internet.

💡 Hint

Routes to an Internet Gateway require the gateway to be attached to the VPC to function.

Even if the route table points to an Internet Gateway, if the gateway is not attached to the VPC, traffic cannot flow through it. This prevents internet access.

❓ Configuration

advanced

Correct Terraform configuration for Internet Gateway attachment

Which Terraform snippet correctly creates and attaches an Internet Gateway to a VPC named 'main-vpc'?

A

resource "aws_internet_gateway" "gw" {
  vpc_id = "main-vpc"
}

B

resource "aws_internet_gateway" "gw" {
  vpc = aws_vpc.main-vpc.id
}

C

resource "aws_internet_gateway" "gw" {
  vpc_id = aws_vpc.main_vpc.id
}

D

resource "aws_internet_gateway" "gw" {
  vpc_id = aws_vpc.main-vpc.id
}

💡 Hint

Terraform resource attributes are case-sensitive and must match resource names exactly.

The correct attribute is 'vpc_id' with the exact resource name 'aws_vpc.main_vpc.id'. Using dashes in resource names is invalid in Terraform identifiers.

✅ Best Practice

expert

Best practice for high availability of Internet Gateway in multi-AZ VPC

You have a VPC spanning multiple Availability Zones (AZs). What is the best practice to ensure high availability of internet access for public subnets in all AZs?

A Create one Internet Gateway attached to the VPC; it automatically provides internet access to all AZs.

B Attach the Internet Gateway to each subnet individually to ensure availability.

C Create a NAT Gateway in each AZ instead of an Internet Gateway for public internet access.

D Create one Internet Gateway per AZ and attach each to the VPC for redundancy.

💡 Hint

Internet Gateways are regional and attached to the VPC, not per AZ or subnet.

An Internet Gateway is a horizontally scaled, redundant, and highly available component that attaches to the VPC. One Internet Gateway serves all AZs in the VPC. Creating multiple Internet Gateways or attaching them to subnets is not supported.