NAT Gateway for private subnet internet in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a NAT Gateway in a public subnet.

AWS

resource "aws_nat_gateway" "example" {
  allocation_id = aws_eip.example.[1]
  subnet_id     = aws_subnet.public.[1]
}

Drag options to blanks, or click blank then click option'

Aid

Barn

Cname

Dcidr_block

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'arn' or 'name' instead of 'id' for resource references.

Confusing subnet CIDR block with subnet ID.

The NAT Gateway requires the Elastic IP allocation ID and the subnet ID where it will be created. Both use the id attribute.

2fill in blank

medium

Complete the route table entry to direct private subnet traffic to the NAT Gateway.

AWS

resource "aws_route" "private_nat" {
  route_table_id         = aws_route_table.private.[1]
  destination_cidr_block = "0.0.0.0/0"
  [1]            = aws_nat_gateway.example.id
}

Drag options to blanks, or click blank then click option'

Agateway_id

Bnat_gateway_id

Cinstance_id

Dnetwork_interface_id

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'gateway_id' which is for Internet Gateways.

Using 'instance_id' which is for EC2 instances.

To route internet-bound traffic from a private subnet through a NAT Gateway, the route must specify nat_gateway_id pointing to the NAT Gateway resource.

3fill in blank

hard

Fix the error in the private subnet route table to enable internet access via NAT Gateway.

AWS

resource "aws_route" "private_route" {
  route_table_id         = aws_route_table.private.id
  destination_cidr_block = "0.0.0.0/0"
  [1]             = aws_nat_gateway.example.id
}

Drag options to blanks, or click blank then click option'

Asubnet_id

Broute_table_id

Cinternet_gateway_id

Dnat_gateway_id

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'gateway_id' for NAT Gateway routes.

Confusing Internet Gateway and NAT Gateway attributes.

The route to a NAT Gateway must use nat_gateway_id instead of gateway_id. The latter is for Internet Gateways.

4fill in blank

hard

Fill both blanks to create a private subnet route table that sends internet traffic through the NAT Gateway.

AWS

resource "aws_route_table" "private" {
  vpc_id = aws_vpc.main.[1]
}

resource "aws_route" "private_internet_access" {
  route_table_id         = aws_route_table.private.[2]
  destination_cidr_block = "0.0.0.0/0"
  nat_gateway_id         = aws_nat_gateway.example.id
}

Drag options to blanks, or click blank then click option'

Aid

Barn

Cname

Dcidr_block

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'arn' or 'name' instead of 'id' for resource references.

Confusing CIDR block with resource ID.

The VPC and route table resources are referenced by their id attributes to correctly link resources.

5fill in blank

hard

Fill all three blanks to associate the private subnet with the private route table and enable NAT Gateway internet access.

AWS

resource "aws_route_table_association" "private_assoc" {
  subnet_id      = aws_subnet.private.[1]
  route_table_id = aws_route_table.private.[2]
}

resource "aws_route" "private_default_route" {
  route_table_id         = aws_route_table.private.[3]
  destination_cidr_block = "0.0.0.0/0"
  nat_gateway_id         = aws_nat_gateway.example.id
}

Drag options to blanks, or click blank then click option'

Aid

Barn

Cname

Dcidr_block

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'arn' or 'name' instead of 'id' for resource references.

Confusing CIDR block with resource ID.

Subnet and route table references require the id attribute to correctly associate and route traffic.

Practice

1. What is the main purpose of a NAT Gateway in AWS for private subnets?

easy

A. To block all internet traffic from private subnets

B. To provide direct internet access to public subnets

C. To assign public IP addresses to private subnet instances

D. To allow instances in private subnets to access the internet securely

Solution

1. Step 1: Understand NAT Gateway role

   A NAT Gateway enables instances in private subnets to initiate outbound internet traffic while preventing inbound internet connections.

2. Step 2: Compare options

   Only To allow instances in private subnets to access the internet securely correctly describes this purpose; others describe unrelated or incorrect functions.

3. Final Answer:

   To allow instances in private subnets to access the internet securely -> Option D

4. Quick Check:

   NAT Gateway purpose = Allow private subnet internet access [OK]

Hint: NAT Gateway = private subnet internet access [OK]

Common Mistakes:

• Confusing NAT Gateway with Internet Gateway
• Thinking NAT Gateway assigns public IPs
• Believing NAT Gateway blocks internet traffic

2. Which AWS resource must a NAT Gateway be associated with to provide internet access for private subnets?

easy

A. An Elastic IP in a public subnet

B. A private IP in a private subnet

C. A security group allowing inbound SSH

D. A VPC endpoint for S3

Solution

1. Step 1: Identify NAT Gateway placement

   NAT Gateway must be placed in a public subnet and associated with an Elastic IP to route internet traffic.

2. Step 2: Evaluate options

   Only An Elastic IP in a public subnet correctly states the Elastic IP in a public subnet; others are unrelated or incorrect.

3. Final Answer:

   An Elastic IP in a public subnet -> Option A

4. Quick Check:

   NAT Gateway needs Elastic IP in public subnet [OK]

Hint: NAT Gateway needs Elastic IP in public subnet [OK]

Common Mistakes:

• Placing NAT Gateway in private subnet
• Associating NAT Gateway with private IP
• Confusing security groups with subnet placement

3. Given a private subnet with route table entry 0.0.0.0/0 -> NAT Gateway, what happens when an instance in this subnet tries to access the internet?

medium

A. Traffic is blocked because private subnets cannot access the internet

B. Traffic goes directly to the Internet Gateway

C. Traffic is routed through the NAT Gateway to the internet

D. Traffic is routed to the VPC endpoint

Solution

1. Step 1: Analyze route table entry

   The route 0.0.0.0/0 -> NAT Gateway directs all internet-bound traffic from the private subnet to the NAT Gateway.

2. Step 2: Understand traffic flow

   The NAT Gateway forwards traffic to the internet, allowing outbound access while hiding private IPs.

3. Final Answer:

   Traffic is routed through the NAT Gateway to the internet -> Option C

4. Quick Check:

   Route 0.0.0.0/0 to NAT Gateway = internet access [OK]

Hint: Route 0.0.0.0/0 to NAT Gateway = internet access [OK]

Common Mistakes:

• Assuming private subnet traffic goes directly to Internet Gateway
• Thinking private subnet traffic is blocked by default
• Confusing VPC endpoint with internet routing

4. You created a NAT Gateway in a public subnet but instances in the private subnet cannot access the internet. What is the most likely cause?

medium

A. The private subnet has a public IP assigned

B. The private subnet route table does not have a route to the NAT Gateway

C. The Internet Gateway is not attached to the VPC

D. The NAT Gateway is missing an Elastic IP

Solution

1. Step 1: Check route table configuration

   Instances in private subnets need a route directing internet traffic (0.0.0.0/0) to the NAT Gateway.

2. Step 2: Identify missing route issue

   If this route is missing, traffic won't reach the NAT Gateway, causing no internet access.

3. Final Answer:

   The private subnet route table does not have a route to the NAT Gateway -> Option B

4. Quick Check:

   Missing route to NAT Gateway = no internet [OK]

Hint: Check private subnet route table for NAT Gateway route [OK]

Common Mistakes:

• Ignoring route table routes
• Assuming Elastic IP is optional
• Confusing Internet Gateway attachment with NAT Gateway routing

5. You want to allow instances in a private subnet to access the internet for software updates but prevent inbound internet traffic. Which setup is correct?

hard

A. Place a NAT Gateway in a public subnet with an Elastic IP and route private subnet traffic (0.0.0.0/0) to it

B. Assign public IPs to private subnet instances and route traffic through the Internet Gateway

C. Place a NAT Gateway in the private subnet and route traffic to it

D. Use a VPC endpoint for internet access

Solution

1. Step 1: Understand NAT Gateway placement and function

   NAT Gateway must be in a public subnet with an Elastic IP to allow outbound internet access for private subnet instances without exposing them to inbound traffic.

2. Step 2: Evaluate options for security and functionality

   Place a NAT Gateway in a public subnet with an Elastic IP and route private subnet traffic (0.0.0.0/0) to it correctly describes this setup. Assign public IPs to private subnet instances and route traffic through the Internet Gateway exposes instances publicly. Place a NAT Gateway in the private subnet and route traffic to it places NAT Gateway incorrectly. Use a VPC endpoint for internet access does not provide internet access.

3. Final Answer:

   Place a NAT Gateway in a public subnet with an Elastic IP and route private subnet traffic (0.0.0.0/0) to it -> Option A

4. Quick Check:

   NAT Gateway in public subnet + route private subnet = secure internet access [OK]

Hint: NAT Gateway in public subnet with route from private subnet [OK]

Common Mistakes:

• Assigning public IPs to private subnet instances
• Placing NAT Gateway in private subnet
• Using VPC endpoint for general internet access