In one sentence
An Internet Gateway is the highly available internet entry and exit point attached to a VPC, but attaching one does not automatically make resources publicly reachable.
Core purpose
- Provide an IPv4 and IPv6 route target between a VPC and the internet.
- Perform one-to-one mapping between private and public IPv4 addresses for instances with public addresses.
- Scale horizontally as an AWS-managed, redundant component.
How it works
Internet ↔ IGW ↔ Route Table ↔ Subnet ↔ ENI / EC2
Successful communication also requires:
- An IGW attached to the VPC.
0.0.0.0/0 → IGW, or::/0 → IGWfor IPv6.- A public IPv4 address or Elastic IP for IPv4.
- Security group, NACL, and host firewall rules that allow the traffic.
- An application listening on the correct port.
Typical uses
- Internet-facing Application Load Balancers.
- Public web servers or bastion hosts.
- The public subnet that contains a public NAT Gateway.
Exam focus
- An IGW connects a VPC to the internet; it is neither a firewall nor a NAT Gateway.
- Understand the complete conditions for a public subnet.
- For outbound-only IPv6, consider an Egress-only Internet Gateway rather than NAT Gateway.
Common misconceptions
- Attaching an IGW does not modify route tables.
- A default route alone does not guarantee internet access.
- An IGW does not filter traffic by port.
- A VPC can have only one attached IGW at a time, but that IGW is already highly available.
Related services
| Service | Purpose |
|---|---|
| Internet Gateway | Direct two-way internet connectivity for eligible resources |
| NAT Gateway | Outbound access for private IPv4 resources |
| Virtual Private Gateway | VPC-side gateway for traditional VPN or Direct Connect designs |
Key takeaway
The IGW is only the doorway; routes, public addresses, and security rules determine whether traffic can actually pass.