Most SAA-C03 candidates can draw a VPC in their sleep: a /16, public and private subnets, an internet gateway, a NAT gateway for the private tier. Then an exam question says the application must be reachable over IPv6, or that the company has run out of private IPv4 space, or that a private subnet needs outbound-only IPv6 access, and the familiar diagram stops working. NAT gateways do not translate IPv6 egress. Private subnets are not private in the IPv4 sense when every address is globally routable. And there is a whole gateway type, the egress-only internet gateway, that exists purely because of these differences.
The VPC concepts guide for SAA-C03 covers the IPv4 building blocks in depth and mentions IPv6 only in passing. This guide fills the gap. It is written for the SAA-C03 “Design Secure Architectures” and “Design High-Performing Architectures” domains, where IPv6 questions appear as variants of scenarios you already know, with one changed word that changes the answer.
Why IPv6 Changes the VPC Model
Three facts drive every IPv6 decision in a VPC. Internalise them and the scenarios become mechanical.
1. IPv6 addresses in a VPC are globally unique and public by default. The AWS documentation states that Amazon-provided IPv6 addresses “are always advertised on the internet. They are globally unique, and therefore reachable over the internet.” There is no RFC 1918 equivalent for the ordinary case (private IPv6 ranges exist, but only via IPAM and they are the exception, covered below). Whether an instance is actually reachable is decided by routing, security groups and network ACLs, not by the address type.
2. There is no NAT for IPv6 egress. A NAT gateway translates private IPv4 to a public IPv4 Elastic IP. Instances with IPv6 addresses do not need translation because they already have public addresses. What they need is a way to send traffic out while blocking unsolicited inbound connections. That is the job of the egress-only internet gateway.
3. IPv4 and IPv6 are independent. A dual-stack VPC runs both protocols side by side. IPv4 can never be removed from a VPC or subnet. Routes, security group rules and NACL rules for one protocol say nothing about the other, so every component that touches IPv6 traffic needs an explicit IPv6 configuration.
Addressing: CIDR Sizes, Sources and Reserved Addresses
VPC and Subnet IPv6 CIDR Blocks
| Scope | IPv6 rule |
|---|---|
| VPC, Amazon-provided block | A fixed /56 from Amazon’s pool |
| VPC, from an IPAM pool or BYOIP | Netmask lengths between /44 and /60 in increments of /4 |
| Subnet | Netmask lengths between /44 and /64 in increments of /4; a /64 is the conventional choice |
| Reserved per subnet | First four addresses and the last address (five total), mirroring the five reserved IPv4 addresses |
| Adding IPv6 to an existing VPC | Supported: associate a block with the VPC, then with individual subnets |
| Converting an IPv4-only subnet to IPv6-only | Not supported. There is no migration path; create a new IPv6-only subnet |
A /56 VPC block divided into /64 subnets gives you 256 subnets, each with 2^64 addresses. Subnet exhaustion simply stops being a design concern, which is one of the reasons the exam presents IPv6 as the answer to “the company is running out of IP addresses” scenarios when the alternative (a secondary IPv4 CIDR) has already been tried or is not large enough.
Where IPv6 Blocks Come From
- Amazon-provided. The default. You tick a box and receive a /56 from Amazon’s globally unique address (GUA) space.
- Bring Your Own IP (BYOIP). You own a public IPv6 range and bring it to AWS, which advertises it on your behalf. Useful when partners or regulators have allow-listed your ranges. The range appears in your account as an address pool that you associate with VPCs.
- Amazon VPC IP Address Manager (IPAM) pools. IPAM is the VPC feature for planning, tracking and allocating address space across accounts and Regions. It can hold Amazon-provided IPv6 ranges, BYOIP ranges, and, uniquely, private IPv6 ranges: unique local addresses (ULA) under fd00::/8, or GUA ranges you own but choose not to advertise. Private IPv6 addresses are only available through IPAM, are never advertised, and are dropped at the internet gateway edge even if a route exists. They are free.
For SAA-C03 the depth required is “Amazon-provided versus BYOIP, and IPAM is where private IPv6 lives”. The multi-account IPAM design patterns belong to the Professional exam and the SAP-C02 networking deep dive.
The Public IPv4 Charge
Since February 2024 AWS charges for every public IPv4 address, including those attached to running instances and Elastic IPs. The exam has started to use this as a cost cue: a question that asks how to “reduce the cost of public IP addresses while keeping instances reachable from the internet” is pointing at dual-stack or IPv6-only designs, because IPv6 addresses carry no per-address charge. The cost-optimised architectures guide covers the other levers; this is the networking one.
Dual-Stack vs IPv6-Only Subnets
| Attribute | Dual-stack subnet | IPv6-only subnet |
|---|---|---|
| CIDRs | IPv4 and IPv6 | IPv6 only, no IPv4 CIDR |
| Instance support | Any instance type that supports IPv6 | Nitro-based instances only |
| Hostnames | IP-based or resource-based naming | Resource-based naming (RBN) required, since there is no IPv4 to embed in the hostname |
| Reaching IPv4-only destinations | Natively over the instance’s IPv4 address, via NAT gateway if private | Only via DNS64 + NAT64 through a NAT gateway |
| Outbound-only internet access | NAT gateway for IPv4, egress-only internet gateway for IPv6 | Egress-only internet gateway |
| Typical use | Public-facing tiers, migration from IPv4 | Large private fleets (containers, nodes) where IPv4 exhaustion is the problem |
Dual-stack is the migration path for existing VPCs and the common choice for anything internet-facing. IPv6-only subnets are the tool for the “we need more addresses than IPv4 can give us” scenario, which is why they are where DNS64 and NAT64 matter most.
Internet Access Over IPv6: The Three Gateways
Internet Gateway (IGW)
An internet gateway handles both protocols. For IPv4 it performs the one-to-one NAT between an instance’s private address and its public or Elastic IP. For IPv6 it performs no translation, because the instance’s address is already public; it simply forwards. A public dual-stack subnet therefore has two default routes to the same IGW:
| Destination | Target |
|---|---|
| 10.0.0.0/16 | local |
| 2001:db8:1234:1a00::/56 | local |
| 0.0.0.0/0 | igw-… |
| ::/0 | igw-… |
With ::/0 pointing at an IGW, external IPv6 hosts can initiate connections to any instance the security groups allow. That is the definition of a public subnet, and for IPv6 it is the only thing that makes a subnet public, since the address itself is public either way.
Egress-Only Internet Gateway (EIGW)
An egress-only internet gateway is, in the words of the documentation, “a horizontally scaled, redundant, and highly available VPC component that allows outbound communication over IPv6 from instances in your VPC to the internet, and prevents the internet from initiating an IPv6 connection with your instances.”
Key properties:
- IPv6 only. It has no role in IPv4 traffic. For outbound-only IPv4, use a NAT gateway.
- Stateful. It forwards outbound traffic and allows the responses back, like a NAT gateway, but without any address translation.
- Free. There is no hourly or per-GB charge for the gateway itself; standard data transfer charges still apply. Compare this with a NAT gateway, which bills per hour and per GB processed.
- No security groups. You cannot attach a security group to an EIGW. Control traffic with NACLs on the subnet and security groups on the instances.
- VPC-scoped and highly available. Unlike a NAT gateway, which lives in one Availability Zone and must be duplicated per AZ for resilience, an EIGW is a VPC-level component with no AZ placement to worry about.
The private dual-stack subnet route table that the exam wants you to recognise:
| Destination | Target |
|---|---|
| 10.0.0.0/16 | local |
| 2001:db8:1234:1a00::/56 | local |
| 0.0.0.0/0 | nat-… (NAT gateway in a public subnet) |
| ::/0 | eigw-… |
If you remember one thing from this article: NAT gateway for private IPv4 egress, egress-only internet gateway for private IPv6 egress, and a private dual-stack subnet needs both.
NAT Gateway, NAT64 and DNS64
A NAT gateway does one IPv6-related job, and it is a specific one: NAT64, translating traffic from IPv6-only workloads to IPv4-only destinations. NAT64 is “automatically available on your existing NAT gateways or on any new NAT gateways you create. It’s not a feature you enable or disable.”
The mechanism needs two parts:
- DNS64, enabled per subnet. When a resource in a DNS64-enabled subnet queries a hostname that has only an IPv4 (A) record, the Route 53 Resolver synthesises an IPv6 address by prefixing the well-known 64:ff9b::/96 prefix (RFC 6052) onto the IPv4 address. If the destination already has an IPv6 (AAAA) record, the original record is returned untouched and no translation occurs.
- A route for 64:ff9b::/96 to the NAT gateway. Packets to the synthesised addresses hit the NAT gateway, which strips the prefix, rewrites the source to its own address, sends IPv4 out through the IGW (or a virtual private gateway or transit gateway for on-premises destinations), and reverses the process on the reply.
The route table for an IPv6-only private subnet that needs to reach both IPv6 and IPv4 destinations:
| Destination | Target | Purpose |
|---|---|---|
| 2001:db8:1234:1a00::/56 | local | In-VPC IPv6 |
| 64:ff9b::/96 | nat-… | IPv4-only destinations via NAT64 |
| ::/0 | eigw-… | Native IPv6 internet, outbound only |
Enabling DNS64 is a single subnet attribute:
aws ec2 modify-subnet-attribute --subnet-id subnet-0123456789abcdef0 --enable-dns64And the NAT64 route:
aws ec2 create-route \
--route-table-id rtb-0123456789abcdef0 \
--destination-ipv6-cidr-block 64:ff9b::/96 \
--nat-gateway-id nat-0123456789abcdef0Security groups and NACLs must allow traffic to and from 64:ff9b::/96 for this to work. Note that the NAT gateway’s own subnet does not need to be dual-stack; it needs an IPv4 route to the internet gateway as usual.
The Gateway Decision Table
| Requirement | Gateway |
|---|---|
| Inbound and outbound IPv4 from the internet | Internet gateway, public IPv4 or Elastic IP |
| Inbound and outbound IPv6 from the internet | Internet gateway, ::/0 route |
| Outbound-only IPv4 from a private subnet | NAT gateway (per AZ for HA) |
| Outbound-only IPv6 from a private subnet | Egress-only internet gateway |
| IPv6-only workload must reach an IPv4-only API | DNS64 on the subnet + NAT gateway with a 64:ff9b::/96 route |
| Private IPv6 that must never reach the internet | IPAM private IPv6 (ULA) range, no ::/0 route |
Security Groups and NACLs for IPv6
Enabling IPv6 on a VPC does not retroactively make any security group or NACL rule apply to it. Every rule is protocol-specific:
- A security group rule allowing HTTPS from
0.0.0.0/0permits IPv4 only. You need a second rule for::/0. - The same holds for NACLs, including the default deny-all behaviour: a custom NACL that allows IPv4 web traffic silently drops IPv6 web traffic until you add matching inbound and outbound IPv6 rules, remembering the ephemeral port range for return traffic.
- Default security groups and default NACLs are updated automatically to include IPv6 equivalents when you associate an IPv6 CIDR with the VPC; custom ones are not.
- Security groups can reference other security groups as sources, which works identically for both protocols and is the cleaner pattern for tier-to-tier rules.
The secure architectures guide for SAA-C03 covers the security group versus NACL distinction in detail; the IPv6 addition is simply that both need a second set of rules.
Adding IPv6 to an Existing VPC: The Checklist
The dual-stack migration path, in order:
- Associate an IPv6 CIDR block with the VPC (Amazon-provided /56, or from BYOIP or an IPAM pool).
- Associate a /64 with each subnet that needs IPv6. You can leave some subnets IPv4-only.
- Update route tables. Public subnets get
::/0to the IGW. Private subnets get::/0to a new egress-only internet gateway. - Update security groups and NACLs with IPv6 rules.
- Enable auto-assign IPv6 on the subnets so new instances receive an address, and assign IPv6 addresses to existing instances (which also requires the guest OS to be configured for IPv6; recent Amazon Linux and Windows AMIs handle this automatically).
- Update dependent services. Load balancers need
dualstackIP address type, Route 53 needs AAAA records, and on-premises connectivity needs IPv6-capable VPN or Direct Connect configuration.
The load balancer guide and the Route 53 routing policies guide cover the ALB dualstack setting and AAAA alias records respectively. An ALB in dualstack mode can front IPv4-only targets, which is the standard way to offer IPv6 to clients without touching the application tier at all.
Where IPv6 Connects to the Rest of the VPC
- VPC peering supports IPv6 traffic between peered VPCs. Add IPv6 routes to the peering connection on both sides; the IPv4 routes do not cover it.
- Transit Gateway supports IPv6 attachments and routes, so hub-and-spoke designs can be dual-stack.
- Site-to-Site VPN supports IPv6 traffic inside the tunnel; the outer tunnel endpoints are IPv4 unless you choose IPv6 outer addresses on a Transit Gateway VPN.
- Direct Connect supports IPv6 BGP peering on private and public virtual interfaces.
- VPC endpoints for AWS services are increasingly dualstack, so IPv6-only subnets can reach S3, DynamoDB and other services privately without NAT64.
- VPC Flow Logs capture IPv6 flows in the same log format, with IPv6 addresses in the source and destination fields.
How IPv6 Shows Up on the SAA-C03 Exam
IPv6 questions are rarely about IPv6 itself. They take a scenario you know and change the protocol, so the usual answer becomes a distractor. Cues to watch for:
- “Instances in a private subnet must initiate connections to the internet over IPv6 but must not be reachable from the internet.” Egress-only internet gateway. A NAT gateway is the IPv4 distractor; an internet gateway allows inbound.
- “The company has exhausted its private IPv4 address space across its VPCs.” Dual-stack or IPv6-only subnets, often with IPAM. A secondary IPv4 CIDR is a weaker answer when the question stresses scale.
- “IPv6-only EC2 instances must call a third-party API that only supports IPv4.” DNS64 on the subnet plus a NAT gateway with a
64:ff9b::/96route. An egress-only internet gateway cannot do this because it does not translate. - “After enabling IPv6, instances cannot be reached on their IPv6 addresses even though the route table is correct.” Missing
::/0or specific IPv6 rules in the security group or NACL. - “Reduce the cost of public IPv4 addresses.” Move internet-facing endpoints to IPv6 or dualstack, with a dualstack ALB in front of IPv4-only targets as the low-effort version.
- “Which instances can run in an IPv6-only subnet?” Nitro-based instances with resource-based naming.
- “Make an existing IPv4 subnet IPv6-only.” Not possible; create a new IPv6-only subnet and migrate.
The SAA-C03 practice questions include VPC scenarios in this style, and the SAA-C03 exam guide shows how networking fits into the four domains. For timed, domain-weighted rehearsal that mixes IPv6 variants in among the IPv4 questions the way the real exam does, the AWS Certified Solutions Architect - Associate (SAA-C03) Mock Exam Bundle is the practice layer; it is the quickest way to find out whether you reach for a NAT gateway by reflex when the question says IPv6.
Practical Guidance from the Field
- Start dual-stack at the edge. A dualstack ALB with AAAA alias records gives external users IPv6 immediately while the application tier stays IPv4. Go deeper only when IPv4 exhaustion or cost demands it.
- Treat every
0.0.0.0/0rule as a prompt. Grep your security groups and NACLs for0.0.0.0/0and decide, rule by rule, whether a::/0twin belongs next to it. - Prefer egress-only internet gateways over NAT gateways for IPv6 egress even in dual-stack subnets. The EIGW is free and inherently multi-AZ; the NAT gateway is neither. Keep the NAT gateway for IPv4 and NAT64.
- Put DNS64 only where it is needed. Enabling it on dual-stack subnets is harmless but confusing; enable it on IPv6-only subnets that actually need to reach IPv4 services.
- Use IPAM from the start for multi-account estates. Hand-allocating /56 blocks per VPC in a spreadsheet is how overlapping ranges happen. IPAM also unlocks private IPv6 if your security team objects to globally unique addresses on internal workloads.
- Test outbound IPv6 explicitly.
curl -6 https://example.comfrom an instance in the private subnet proves the::/0to EIGW route and the security group egress rule in one command.
Conclusion
IPv6 in Amazon VPC is not a new networking model; it is the familiar one with three adjustments. Addresses are public by default, so routing and security groups carry the whole burden of exposure control. There is no NAT for IPv6 egress, so the egress-only internet gateway replaces the NAT gateway for outbound-only private subnets and does so for free and without per-AZ duplication. And IPv4 and IPv6 are independent, so every route table, security group and NACL needs explicit IPv6 entries. DNS64 and NAT64 close the last gap by letting IPv6-only workloads reach the IPv4-only internet through a NAT gateway and the 64:ff9b::/96 prefix.
For the SAA-C03 exam, know the /56 and /64 sizes, the Nitro requirement for IPv6-only subnets, the gateway decision table, and the fact that a security group rule for 0.0.0.0/0 says nothing about ::/0. Then practise until the word “IPv6” in a question changes your answer automatically.
Frequently Asked Questions
What is the difference between an egress-only internet gateway and a NAT gateway?
A NAT gateway provides outbound-only internet access for IPv4 by translating private addresses to a public Elastic IP, is deployed per Availability Zone, and is billed per hour and per gigabyte. An egress-only internet gateway provides outbound-only internet access for IPv6, performs no translation because IPv6 addresses are already public, is a VPC-level highly available component, and has no charge beyond data transfer. A private dual-stack subnet typically routes 0.0.0.0/0 to a NAT gateway and ::/0 to an egress-only internet gateway.
Are IPv6 addresses in a VPC public?
Amazon-provided IPv6 addresses are globally unique and publicly routable by default. An instance is only reachable from the internet, however, if its subnet’s route table has a ::/0 route to an internet gateway and its security group and NACL allow the traffic. Private IPv6 ranges (ULA or non-advertised GUA) are available only through Amazon VPC IPAM and are never advertised.
What are DNS64 and NAT64 used for?
They let IPv6-only resources communicate with IPv4-only destinations. DNS64, enabled per subnet, makes the Route 53 Resolver synthesise an IPv6 address from an IPv4-only DNS record by adding the 64:ff9b::/96 prefix. NAT64, built into every NAT gateway, translates packets sent to those synthesised addresses into IPv4 and back. You need both, plus a route for 64:ff9b::/96 to the NAT gateway.
Can I convert an existing IPv4 subnet to IPv6-only?
No. AWS documents that there is no migration path from IPv4-only subnets to IPv6-only subnets. You can add an IPv6 CIDR to make an existing subnet dual-stack, or create a new IPv6-only subnet and move workloads to it.
What IPv6 CIDR size does a VPC and a subnet get?
An Amazon-provided VPC block is a fixed /56. Blocks from IPAM or BYOIP can be between /44 and /60 in /4 increments. Subnets can use netmasks between /44 and /64 in /4 increments, with /64 the conventional size. The first four and the last address of each subnet are reserved, matching the five reserved IPv4 addresses.
Do my existing security group rules apply to IPv6 traffic?
No. Rules are protocol-specific. A rule for 0.0.0.0/0 covers IPv4 only; you need a separate rule for ::/0 or specific IPv6 ranges. The same applies to network ACLs. Only the default security group and default NACL are updated automatically when you add an IPv6 CIDR to a VPC.
Which instances can run in an IPv6-only subnet?
Only Nitro-based instance types, and they must use resource-based naming for their hostnames because there is no IPv4 address to derive an IP-based hostname from. Older Xen-based instance families cannot be launched into IPv6-only subnets.