Instances in a public subnet cannot download patches. The subnet route table sends 0.0.0.0/0 to an internet gateway. The instances have no public IPv4 address, and there is no route to a NAT gateway. What gives them egress with the least change?
Select an answer to reveal the explanation.
Short Explanation
Your internet gateway route is in place, but the instances have no public IPv4 address to use with it. Assigning a public IPv4 address gives them egress; an inbound rule cannot provide that address.
Full Explanation
An internet gateway route alone does not give an instance internet access: the instance also needs a public IPv4 address to communicate through that gateway. Assigning a public IPv4 address to each instance that needs patches is the least change because it uses the route already in the subnet’s route table. An inbound rule for port 80 does not create an address or provide the missing egress path; it only permits matching inbound traffic, and the instances remain without public addresses. Removing the internet gateway route removes the subnet’s existing route to the internet rather than enabling downloads. Enabling VPC Flow Logs records network traffic for analysis but does not change addressing or provide connectivity. Exam caveat: a public IPv4 address makes an instance reachable from the internet if its security group or network ACL permits inbound traffic, so keep inbound access restricted. Practical check: confirm each instance has a public IPv4 address, the default route still targets the internet gateway, and an outbound connection to the patch source succeeds. A public address without that internet gateway route would not provide the required path; both pieces must be present.