A VPC has both an IPv4 and an IPv6 CIDR block. The team wants instances to be able to initiate outbound IPv6 connections to the internet, while preventing any host on the internet from initiating an inbound IPv6 connection to those instances. Which component should they add, and what is a key property of it?
- A NAT gateway, since NAT gateways handle both IPv4 and IPv6 outbound-only traffic identically
- An egress-only internet gateway, which handles IPv6 traffic only, is stateful (it forwards requests out and returns the responses), and cannot have a security group attached to it directly
- An internet gateway with a restrictive network ACL, since internet gateways are outbound-only by default for IPv6
- An egress-only internet gateway, which is stateless and requires a matching inbound rule for every outbound connection's response traffic
Why B? And why not the others?
Correct answer: B. An egress-only internet gateway, which handles IPv6 traffic only, is stateful (it forwards requests out and returns the responses), and cannot have a security group attached to it directly
AWS documents the egress-only internet gateway as 'for use with IPv6 traffic only,' explicitly stateful ('it forwards traffic from the instances in the subnet to the internet or other AWS services, and then sends the response back to the instances'), and notes 'you can't associate a security group with an egress-only internet gateway,' though a network ACL on the subnet can still control its traffic. Because IPv6 addresses are globally routable by default, this component lets instances reach out over IPv6 without becoming reachable from unsolicited inbound connections. Option A is wrong because NAT gateways handle IPv4 translation; the IPv6 outbound-only equivalent is specifically the egress-only internet gateway, a separate resource. Option C is wrong because a standard internet gateway is bidirectional for any address it routes and has no such built-in IPv6-outbound-only restriction. Option D is wrong on the statefulness: the egress-only internet gateway is stateful, so no matching inbound rule is required for return traffic, unlike a stateless device such as a network ACL.
Source: AWS VPC docs: Enable outbound IPv6 traffic using an egress-only internet gateway