MushyBook
All challenges

NAT for private egress

beginner
Scenario & brief

The app servers were dropped in a public subnet for one reason: they need outbound internet access to pull packages and patches. But that also leaves them exposed.

Do it the right way: keep the ALB public, move the app servers to a private subnet (reachable only from the ALB), and add a NAT gateway so they can still reach out for updates without accepting any inbound traffic.

1,200 rps peakp99 ≤ 200ms99.9% availdurability: standardbudget $200/mo

Load Balancer

Networking

System health

Erupting · SLA breach

25

/ 100

Score

SLA not met yet

Monthly cost

$22

Budget $200/mo · within budget

Metrics

Security posture0
Connectivity67
Requirements met50

Requirements

  • Load balancer stays public — internet-facing (need internet-facing)
  • App servers in a private subnet — public subnet (need private subnet)
  • App servers not reachable from the internet — internet-reachable (need not internet-reachable)
  • Private subnet gets outbound access via NAT — no NAT (need private egress via NAT)

Advisor

  • App servers in a private subnet: Move it to the private subnet.
  • App servers not reachable from the internet: Put it in a private subnet, drop the public IP, and don't allow ingress from the internet.

Discussion

Sign in to join the discussion.

No comments yet. Be the first to start the discussion.

For learning purposes only. Costs and capacities are illustrative, not live AWS prices. Not affiliated with or endorsed by Amazon Web Services.