Instances in a private subnet need outbound IPv6 and must not accept connections started from the internet. The route table sends the IPv4 default route to a NAT gateway and has no IPv6 default route. What should be added?
Select an answer to reveal the explanation.
Short Explanation
The NAT gateway is an IPv4 ferry, and your IPv6 clients are standing at the wrong dock. You add an egress-only internet gateway and a default IPv6 route that points at it. Aiming the IPv6 route at the NAT gateway does not give those clients a path out.
Full Explanation
A NAT gateway forwards IPv4. The private route table's IPv4 default route gives these instances IPv4 egress and does nothing for IPv6. Outbound IPv6 from a private subnet that must not accept connections started from the internet uses an egress-only internet gateway. Add that gateway and a default IPv6 route whose target is the gateway. A default IPv6 route aimed at the NAT gateway sends traffic to a device that does not forward IPv6. A route to an internet gateway would allow connections started from the internet as well as egress, which breaks the private-subnet requirement. A peering route toward the NAT subnet does not create an IPv6 internet exit. Peering reaches a CIDR in another VPC, not the public internet. Caveat: the VPC and the subnet need an IPv6 CIDR, and the network ACL has to allow the IPv6 outbound flow and the return traffic because network ACLs are stateless. Operational check: confirm the private route table shows the IPv6 default route on the egress-only internet gateway, then open an outbound IPv6 connection from an instance.