Follow the request/data flow through the architecture.
Work through each concept and mark it understood. This unlocks the knowledge check.
Lets private-subnet resources make outbound internet connections while staying unreachable inbound.
Why it matters
Enables patching/updates for private instances without exposing them.
When to use it
Use when private resources need egress (e.g. pulling packages). One per AZ for HA.
Gotcha (exam trap)
NAT Gateways bill hourly AND per-GB processed — a common surprise line item. VPC endpoints can bypass it for AWS-service traffic.
A realistic main.tf for this mission. Read it top to bottom — it mirrors the concepts above.
# NAT Gateway, Peering & VPN
# BleepxCloud — AWS · Advanced
# Realistic starter — adapt names, regions and CIDRs to your environment.
terraform {
required_providers { aws = { source = "hashicorp/aws", version = "~> 5.0" } }
}
provider "aws" {
region = "eu-west-1" # pick a region close to users / data-residency rules
}
# FinOps: mandatory cost-allocation tags on every resource.
locals {
common_tags = {
Project = "bleepx-cloud"
Domain = "core"
Mission = "vpc-advanced"
ManagedBy = "terraform"
CostCenter = "REPLACE_ME"
}
}
data "aws_caller_identity" "current" {}
# NAT lets private subnets reach the internet outbound only.
resource "aws_eip" "nat" { domain = "vpc" }
resource "aws_nat_gateway" "main" {
allocation_id = aws_eip.nat.id
subnet_id = aws_subnet.public[0].id # NAT lives in a PUBLIC subnet
}
resource "aws_route" "private_egress" {
route_table_id = aws_route_table.private.id
destination_cidr_block = "0.0.0.0/0"
nat_gateway_id = aws_nat_gateway.main.id
}
Bleepx skills build on each other. Continue your learning path across Query, Lab, and Cloud.