netwotking

What does a NAT Gateway do, and where does it sit?

It lets private instances reach the internet, using a public IP, but blocks incoming connections. It sits in the public subnet.

What makes a subnet public?

Its route table sends 0.0.0.0/0 to an Internet Gateway. A private subnet has no such route, or it points to a NAT instead.

Stateful vs stateless: Security Group vs NACL?

stateful: remembers the connection, so replies are allowed automatically. NACL = stateless: checks every packet, so you need outbound ephemeral ports 1024 to 65535.

What path does a request take to your site?

Browser → DNS → EC2 public IP → security group → NGINX → page.