A company already has an internet gateway named igw-prod attached to VPC-A. An engineer tries to attach a second internet gateway, igw-backup, to the same VPC-A for redundancy. What happens?
- The attempt fails, because a VPC can only have one internet gateway attached to it at any given time; redundancy for internet access is instead achieved through the internet gateway's own highly available, horizontally scaled design, not by attaching a second one
- The attempt succeeds, and traffic is automatically load-balanced across both internet gateways based on route table weights
- The attempt succeeds, but only one of the two internet gateways can be referenced in route tables at a time, requiring manual failover
- The attempt succeeds only if igw-backup is created in a different Availability Zone from igw-prod
Why A? And why not the others?
Correct answer: A. The attempt fails, because a VPC can only have one internet gateway attached to it at any given time; redundancy for internet access is instead achieved through the internet gateway's own highly available, horizontally scaled design, not by attaching a second one
A VPC can have at most one internet gateway attached at a time; to attach a different one, the existing internet gateway must first be detached. This isn't a redundancy gap, because an internet gateway is itself a horizontally scaled, redundant AWS-managed component that spans the Region rather than living in a single device or Availability Zone, so it needs no second instance for high availability. The load-balancing option is wrong because there is no mechanism for splitting traffic across two internet gateways on one VPC — the attach operation itself is rejected while an internet gateway is already attached. The 'only one active in route tables' option is wrong for the same reason: the second internet gateway is never actually attached, so there's nothing to select between in a route table. The Availability-Zone option is wrong because internet gateways are not zonal resources at all; they operate at the VPC level across every Availability Zone the VPC uses, so creating one in a 'different Availability Zone' isn't a meaningful distinction that changes the one-per-VPC rule.
Source: AWS VPC User Guide: Internet gateways — 'A VPC can have only one internet gateway attached at a time.'