Skip to main content
This lesson explains how Internet Gateways (IGWs) make VPC resources reachable from — and able to reach — the internet. By default, subnets you create in a VPC are private: instances in those subnets cannot initiate connections to the internet, and hosts on the internet cannot initiate connections to them.
A network diagram titled "Internet Gateway" showing a default VPC and Availability Zone 2 containing a private subnet with an instance icon. Dashed lines with red X marks indicate the private subnet's connections to the Internet are blocked.
What an Internet Gateway is
  • An Internet Gateway (IGW) is a horizontally scaled, redundant VPC component that provides a target in your VPC route tables for internet-routable traffic.
  • An IGW is attached to a VPC and is region-resilient: it serves all Availability Zones in that region.
  • If there is no IGW attached to a VPC, all subnets in that VPC remain private (no direct internet connectivity).
Constraints How to make a subnet public Creating an IGW is necessary but not sufficient to make a subnet public. The required sequence is:
  1. Create an Internet Gateway.
  2. Attach the Internet Gateway to the target VPC.
  3. Create (or use) a custom route table for the VPC.
  4. Add a default route — 0.0.0.0/0 for IPv4 (and ::/0 for IPv6 if applicable) — in that route table that targets the Internet Gateway.
  5. Associate the subnet you want to be public with that route table.
When a packet doesn’t match any more specific route, it matches the default route and is forwarded to the IGW, which sends it to the internet.
A cloud network diagram showing an AWS Internet Gateway attached to a default VPC with a public subnet in Availability Zone 2 and a route table listing 172.16.0.0/1/2 subnets. The left column lists the setup steps: Create an Internet Gateway, Attach IGW to VPC, Create custom route table, and Configure default route.
Public IP addressing and reachability
  • Instances launched into a public subnet receive a private IP address by default. To be reachable from the internet an instance also needs a public IP.
  • Many subnets (for example, default VPC subnets) have auto-assign public IPv4 enabled so instances receive a public IP automatically at launch. Otherwise, you can assign a public IP manually.
  • Two common ways to provide a public IP:
    • Auto-assign a public IPv4 address during instance launch (or enable auto-assign on the subnet).
    • Allocate an Elastic IP (EIP) and associate it with the instance.
AWS maps the instance’s public IP (or Elastic IP) to its private IP using network address translation (NAT) at the VPC edge. The instance typically only knows its private IP; incoming traffic to the public IP is translated and delivered to the private IP.
A diagram of an AWS public subnet showing a resource with a private IP (192.163.1.1) mapped to a public IP (1.1.1.1) that a user accesses from outside the AWS Cloud.
Public IP vs Elastic IP: auto-assigned public IPs change when the instance stops and restarts, while Elastic IPs are static and remain allocated to your account until you explicitly release them.
Summary
  • Internet Gateways allow VPC resources to send traffic to, and receive traffic from, the internet.
  • An IGW is region-resilient and covers all Availability Zones in the region.
  • A VPC can have at most one IGW attached; an IGW can be attached to only one VPC.
  • A subnet becomes public when it is associated with a route table whose default route (0.0.0.0/0) points to the IGW, and instances in that subnet have a public IP (auto-assigned or an Elastic IP).
Links and references

Watch Video