World map

 

BM

World A3: The Mall's Roads

Internet and NAT gateways

You will learn: how public rows reach the street, and how back rooms go out without letting anyone in.

Checked with AWS 2026-11 on 1 Nov 2026

The problem

Your app server lives in a back room. It needs a security update from the internet. But nobody outside may walk in. What do you add?

Watch

The Internet gateway: The mall's main entrance from the street. It lets public rows talk to the internet, both ways. is the mall’s main entrance. Traffic goes both ways. Put the steps to open a public row in order.

First step at the top. Put these in order. Use the arrows, or drag.

  • Create an internet gateway
  • Give the server a public IP
  • Attach it to your VPC
  • Add the road sign 0.0.0.0/0 → the gateway

Watch

A NAT gateway: A one-way staff door: back rooms can go out to fetch things, but nobody outside can walk in. Billed by the hour. is a one-way staff door. Back rooms may go out. Nobody outside may start a visit. Which of these work?

Drag a card into a box. Or tap the card, then tap the box.

      Try it

      Point the private row’s road sign at the NAT gateway. Build the command.

      Tap the pieces in the right order.

      …

      Predict

      Your NAT gateway sits idle all night. No traffic at all. Does it cost money?

      Check

      Some road parts cost money while idle. Some are free. Judge each one.

      One at a time: does it keep costing money while it sits idle?

      1 of 4

      NAT gateway with no traffic

      On the bill (costs even when idle)

      Nothing here yet.

      Free shelf (free when idle)

      Nothing here yet.

      You did it!

      You can now give public rows a street door, and back rooms a one-way exit.

      Go deeper (optional)

      A public NAT gateway sits in a public row and needs an Elastic IP. Here is the official example’s answer, cut short. Practising? Skip NAT: the default VPC needs none. Made one? Delete it, then release its Elastic IP.

      bash
      aws ec2 create-nat-gateway --subnet-id subnet-0250c25a1fEXAMPLE --allocation-id eipalloc-09ad461b0dEXAMPLE
      {
      "NatGateway": {
      "NatGatewayId": "nat-0c61bf8a12EXAMPLE",
      "State": "pending",
      "SubnetId": "subnet-0250c25a1fEXAMPLE",
      "ConnectivityType": "public"
      ...