A security engineer has designed a VPC to segment private traffic from public traffic. The VPC includes two Availability Zones. Each Availability…

The problem describes a misconfiguration where subnets intended to be private have a direct route to the internet gateway, making them public. To remediate this, instances in the private subnets need a way to access the internet for tasks like software updates without being directly exposed. This is the function of a NAT gateway.

For a resilient and cost-effective architecture, a NAT gateway should be provisioned in a public subnet within each Availability Zone (AZ). Then, the route tables associated with the private subnets must be modified. The default route (0.0.0.0/0) should be changed from the internet gateway to the NAT gateway located in the same AZ. This ensures private resources can initiate outbound traffic to the internet while remaining isolated from inbound connections.

B. A NAT gateway must be placed in a public subnet to have a route to the internet; placing it in a private subnet would render it non-functional.

C. Every VPC route table automatically includes a non-modifiable local route for the VPC CIDR range, so this action is both unnecessary and impossible.

E. Routing 0.0.0.0/0 to the internet gateway is the definition of a public subnet and describes the exact misconfiguration that needs to be corrected.

1. Amazon VPC User Guide, "NAT gateways": "To create a NAT gateway, you must specify the public subnet in which the NAT gateway should reside... You must also update the route table associated with one or more of your private subnets to point internet-bound traffic to the NAT gateway." This supports options A and D. The guide also states, "For Availability Zone independence, create a NAT gateway in each Availability Zone and configure your routing to ensure that resources use the NAT gateway in the same Availability Zone." This further validates the specifics of options A and D.

Source: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html (See sections: "NAT gateway basics" and "NAT gateway use cases").

2. Amazon VPC User Guide, "Route tables for your VPC": "Every route table contains a local route for communication within the VPC... This route is added by default to all route tables. You can't modify or remove it." This confirms that option C is incorrect. The guide also defines a public subnet as one with a route to an internet gateway, confirming that option E describes the problem, not the solution.

Source: https://docs.aws.amazon.com/vpc/latest/userguide/VPCRouteTables.html (See section: "Route table basics").

3. AWS Well-Architected Framework - Reliability Pillar: This framework emphasizes designing systems that withstand component failures. The recommendation to deploy NAT gateways in each AZ and route traffic to the local NAT gateway aligns with the principle of building highly available, fault-tolerant systems by avoiding cross-AZ dependencies, which could become single points of failure.

Source: https://docs.aws.amazon.com/wellarchitected/latest/reliability-pillar/design-for-failure.html (See section: "Withstand component failures").