A SysOps administrator is troubleshooting internet connectivity from an Amazon EC2 instance residing in a newly created private subnet of a VPC. A NAT gateway has been provisioned in a public subnet of the same VPC. The private subnet's route table contains a route targeting the NAT gateway for . The security group associated with the EC2 instance allows all outbound traffic. However, the EC2 instance is unable to download software updates from the internet. Which of the following is the most likely cause of this issue?
- AThe network ACL associated with the private subnet blocks outbound traffic to the NAT gateway because outbound ephemeral ports (-) are not allowed.
- BThe route table associated with the private subnet is missing an explicit gateway VPC endpoint association for S3 and DynamoDB traffic.
- The route table associated with the public subnet containing the NAT gateway does not have a route pointing to the Internet Gateway for .Cevap
- DThe NAT gateway is configured to route traffic across Availability Zones to the EC2 instance, which is prohibited without an active Transit Gateway.
Cevap
The route table associated with the public subnet containing the NAT gateway does not have a route pointing to the Internet Gateway for .
For a NAT gateway to function, it must reside in a public subnet. A public subnet is defined as a subnet whose associated route table contains a route pointing to an Internet Gateway (). Without this route, the NAT gateway cannot send translated outbound packets to the internet or receive corresponding inbound response packets, which prevents the private EC2 instance from establishing internet connections.
Adım Adım Çözüm
Anahtar Kavram
Subnet route table inheritance and NAT gateway internet dependencies