Internet Gateway

What is an internet gateway?

An internet gateway (IGW) is the VPC’s door to the public internet: a horizontally-scaled, redundant AWS-managed component that performs the translation between instances’ private addresses and their public/Elastic IPs. It has no bandwidth cap you manage, no instances to size, no charge for the gateway itself — attach one per VPC and forget it exists.

The three-condition checklist

An instance is internet-reachable only when all three hold: the VPC has an attached IGW; the instance’s subnet routes 0.0.0.0/0 to that IGW; and the instance has a public or Elastic IP. Miss any one and traffic dies — and because the symptoms look identical (timeouts), the checklist order matters when debugging. Security groups and NACLs then gate which traffic flows; the IGW itself filters nothing.

IGW versus the alternatives

The IGW provides bidirectional connectivity — inbound requests can reach public instances. That’s exactly what private tiers must not have, which is why they use a NAT gateway instead: outbound-only, no unsolicited inbound. The egress-only internet gateway is the IPv6 twin of NAT’s behavior (since IPv6 has no NAT, it enforces outbound-only at the gateway). Choosing among the three is choosing your exposure model, not your bandwidth.

What people get wrong

• Treating the IGW as a security layer — it translates and forwards; exposure control lives in routing, IPs, and security groups.
• Public IPs on things that only need outbound: give them NAT instead; every public IP is attack surface and, on AWS, now a billable line item.
• Assuming one IGW per subnet — it’s per-VPC; “public” is a property of each subnet’s route table.

Primary source: AWS VPC documentation — internet gateways