How does an Internet Gateway (IGW) work in AWS

 

An Internet Gateway (IGW) is a key component in an AWS Virtual Private Cloud (VPC) that enables communication between your VPC resources and the internet. It acts as a bridge between your private cloud resources and the public internet. Here's a detailed breakdown of how an Internet Gateway (IGW) works in AWS:

 

 Key Functions of an Internet Gateway (IGW)

1. Enabling Inbound and Outbound Internet Traffic:

   - Outbound Traffic: When instances in your VPC (in a public subnet) send requests to the internet, the Internet Gateway allows this outbound traffic to reach its destination on the internet.

   - Inbound Traffic: When responses from the internet need to reach your instances, the Internet Gateway allows this traffic to enter the VPC.

 

2. Maintaining Elastic IPs and Public IPs:

   - An IGW can map public IP addresses or Elastic IPs to instances inside your VPC, allowing them to communicate with the internet. When an instance is assigned a public IP address, the IGW routes traffic to and from that IP.

 

3. Performing Network Address Translation (NAT):

   - An IGW allows one-to-one Network Address Translation (NAT) between private IP addresses of instances and their associated public IP addresses. This enables instances to maintain a private IP in the VPC while still being reachable via the public IP.

 

 How an Internet Gateway (IGW) Works

1. Attachment to a VPC:

   - The IGW must be explicitly attached to a VPC to function. A single VPC can have only one attached IGW. This attachment creates the connection between the VPC and the internet.

 

2. Route Table Configuration:

   - To use the IGW, you need to configure a route table for your VPC’s subnets. Specifically, you must add a route that directs all traffic destined for the internet (typically `0.0.0.0/0`) through the Internet Gateway.

   - For example:

     ```

     Destination: 0.0.0.0/0 → Target: igw-xxxxxxxx

     ```

 

3. Public Subnets and Private Subnets:

   - Public Subnets: Subnets with a route to the IGW are considered public subnets. Resources (like EC2 instances) in these subnets can receive inbound traffic from and send outbound traffic to the internet.

   - Private Subnets: These subnets do not have a route to the IGW and typically use a NAT Gateway to access the internet securely for outbound traffic.

 

4. Security Group and NACL Rules:

   - Even if an instance is in a public subnet, inbound and outbound traffic must also be allowed by Security Groups and Network Access Control Lists (NACLs). This adds an additional layer of security.

 

 Summary

The Internet Gateway (IGW) is a vital component that allows AWS VPC resources to communicate with the public internet. It handles routing and NAT, enabling instances with public IPs to send and receive traffic. By connecting an IGW to a VPC and configuring the necessary route tables, AWS customers can securely and efficiently manage internet communication for their cloud infrastructure.