Loading…
While this loads — worth knowing
ElastiCache RedisnotElastiCache Memcached
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
Loading…
While this loads — worth knowing
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
The door between a VPC and the internet. A subnet whose route table points at it is a public subnet.
Where Internet Gateway takes you6 steps, all open
An internet gateway connects a VPC to the internet, for IPv4 and IPv6. It is horizontally scaled, redundant and highly available, so it adds no availability risk and no bandwidth limit to your traffic.
It does two jobs. It is the target in a route table for internet-bound traffic, and for IPv4 it translates one to one between an instance's private address and its public one. A subnet whose route table sends traffic to it is a public subnet.
There is no charge for an internet gateway itself; data transfer to and from the internet is charged.
Visitors can only find a flat that has a street address, and residents can only leave through the gate if there is a sign pointing to it. The porter at the gate swaps the street address for the flat number on the way in, and back again on the way out.
Internet gateway0.0.0.0/0Public IPv4One-to-one NATNo route| Component | Default VPC | A VPC you create |
|---|---|---|
| Internet gateway | Yes | No |
| Route for 0.0.0.0/0 to it | Yes | No |
| Public IPv4 address on launch | Yes, in default subnets | No |
Only the load balancer needs a public address. The web servers sit in private subnets with no route to the internet gateway; the load balancer reaches them over the VPC's own network, and that is the only way in. Fewer public IPv4 addresses also means a smaller bill.
The internet can only reach an instance with a public IPv4 or Elastic IP address.
Translates the public address to the instance's private address and delivers it into the VPC.
The subnet's rules, lowest number first.
Only allow rules: the port must be allowed from this source.
The subnet's route table must send internet traffic back to the internet gateway.
Pick a case to follow the request through each check.
Filter at the resource and the subnet. Security groups on each resource and network ACLs on each subnet decide what traffic arriving through the internet gateway may reach it.
Hand out as few public addresses as you can. Put resources in private subnets and let a load balancer be the only public face.
Connect without a public address. EC2 Instance Connect Endpoint reaches an instance from the internet with no public IPv4 address on it.
The gateway itself is free. There is no charge for an internet gateway.
Data transfer is charged for traffic between your instances and the internet.
Every public IPv4 address is charged by the hour, whether it was assigned to a running instance at launch or is an Elastic IP address, in use or idle.
Prices change, so none are printed here. Check the VPC and EC2 pricing pages on aws.amazon.com.
| Option | Traffic | Who can start a connection | Charged | Choose it when |
|---|---|---|---|---|
| Internet gateway | IPv4 and IPv6 | Either side | No; data transfer is | Resources must be reachable from the internet |
| Egress-only internet gateway | IPv6 only | Only your instances | No; data transfer is | IPv6 instances need out, not in |
| NAT gateway | IPv4, and IPv6 to IPv4 with NAT64 | Only resources inside the VPC | By the hour and by the GB processed | Private IPv4 instances need out |
| Gateway endpoint | To S3 and DynamoDB | Only your instances | No | Private access to S3 or DynamoDB |
what makes a subnet publicA route to an internet gateway in its route table
Nothing else does: not its name, and not the instances in it.
the instance is in a public subnet but cannot be reachedIt has no public IPv4 address
The internet gateway translates only for instances with a public IPv4 or Elastic IP address.
IPv6 instances must reach the internet, but not be reached from itAn egress-only internet gateway
Stateful and IPv6 only. For IPv4 the same job is a NAT gateway.
an instance with an Elastic IP cannot reach the internetIts subnet has no route to the internet gateway
A public address is not enough without the route.
is the internet gateway a single point of failureNo
It is horizontally scaled, redundant and highly available, with no bandwidth constraint.
reduce the number of public IPv4 addressesOne load balancer in front, instances in private subnets
Every public IPv4 address is charged; a load balancer uses just its own.
A developer creates a new VPC without the console wizard, adds a subnet, and launches a web server into it with a public IPv4 address. Its security group allows HTTPS from anywhere, but browsers time out when they try to reach it. What should the developer do?
Customers on the internet must reach a load balancer in public subnets, which sends their requests on to web servers in private subnets. What connects the VPC to the internet?
0.0.0.0/0 to an internet gateway.This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.
Next: NAT GatewayLets instances in private subnets connect out, while nothing outside can start a connection to them.
Open NAT GatewayEvery fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.