MushyBook
All challenges

NAT for private egress

beginner

Scenario & brief

The app servers were dropped in a public subnet for one reason: they need outbound internet access to pull packages and patches. But that also leaves them exposed.

By the end, the app tier should be unreachable from the internet directly — reachable only via the ALB — while still able to reach out for package and patch updates. The ALB stays the one public entry point.

1,200 rps peakp99 ≤ 200ms99.9% availdurability: standardbudget $200/mo

Load Balancer

Networking

System health

Erupting · SLA breach

25

/ 100

Score

SLA not met yet

Monthly cost

$22

Budget $200/mo · within budget

Metrics

Security posture0
Connectivity67
Requirements met50

Requirements

  • Load balancer stays public — internet-facing (need internet-facing)
  • App servers in a private subnet — public subnet (need private subnet)
  • App servers not reachable from the internet — internet-reachable (need not internet-reachable)
  • Private subnet gets outbound access via NAT — no NAT (need private egress via NAT)

Advisor

  • App servers in a private subnet: Move it to the private subnet.
  • App servers not reachable from the internet: Put it in a private subnet, drop the public IP, and don't allow ingress from the internet.

Discussion

Sign in to join the discussion.

No comments yet. Be the first to start the discussion.

For learning purposes only. Costs and capacities are illustrative, not live AWS prices. Not affiliated with or endorsed by Amazon Web Services.