An Internet Gateway (IGW) is a networking component in Amazon Web Services (AWS) that enables communication between an Amazon Virtual Private Cloud (VPC) and the public internet. It is a highly available, horizontally scaled, and fully managed service that allows resources in a public subnet to send and receive internet traffic. An Internet Gateway is essential when you want services such as Amazon EC2 instances to be accessible from the internet or to access external resources online.
How Does an Internet Gateway Work?
An Internet Gateway is attached to a VPC and works together with route tables and public IP addresses.
The basic workflow is:
- Create or attach an Internet Gateway to a VPC.
- Update the VPC's route table by adding a route (such as
0.0.0.0/0) that points to the Internet Gateway.
- Launch resources in a public subnet.
- Assign a public IPv4 address or Elastic IP to those resources.
Once these steps are completed, the resources can communicate with the internet while AWS manages the routing behind the scenes.
Key Features of an Internet Gateway
- Provides internet connectivity for resources in a VPC.
- Supports both inbound and outbound communication.
- Highly available and automatically scaled by AWS.
- Supports both IPv4 and IPv6 traffic.
- Integrates seamlessly with VPC route tables.
- Does not require manual maintenance or scaling.
Example
Imagine you host a web application on an EC2 instance. To allow users to access the website from anywhere on the internet, you would:
- Attach an Internet Gateway to your VPC.
- Configure the public subnet's route table to send internet-bound traffic to the IGW.
- Assign a public IP address to the EC2 instance.
- Configure Security Groups and Network ACLs to allow HTTP (Port 80) or HTTPS (Port 443).
Without an Internet Gateway, the instance would remain isolated from the public internet, even if it had a public IP address.
Internet Gateway vs. NAT Gateway
Although both components relate to internet connectivity, they serve different purposes:
- Internet Gateway (IGW): Enables resources with public IP addresses to communicate directly with the internet in both directions.
- NAT Gateway: Allows instances in private subnets to initiate outbound internet connections while preventing unsolicited inbound traffic. A NAT Gateway itself relies on an Internet Gateway for internet access.
Best Practices
- Use an Internet Gateway only for resources that require direct internet access.
- Keep databases and internal application servers in private subnets.
- Protect internet-facing resources with Security Groups and Network ACLs.
- Follow the principle of least privilege by allowing only the necessary inbound ports.
- Continuously monitor network traffic using AWS monitoring and logging services.
Conclusion
An Internet Gateway is a fundamental component of AWS networking that connects a VPC to the public internet. By attaching an IGW to a VPC, configuring route tables, and assigning public IP addresses, organizations can securely expose web applications and other internet-facing services. When combined with proper security controls and subnet design, Internet Gateways provide a scalable and reliable foundation for building cloud-native applications on AWS.