A security engineer is working with a company to design an ecommerce application. The application will run on Amazon EC2 instances that run in an Auto Scaling group behind an Application Load…

A NAT gateway has a static Elastic IP address. Placing NAT gateways in each private subnet's Availability Zone ensures that all outbound traffic from the EC2 instances exits through a known, fixed IP that can be added to the external payment provider's allowlist, even as Auto Scaling adds or removes instances.

Placing the RDS DB instance in a public subnet exposes the database directly to the internet, creating an unnecessary and significant security vulnerability that violates AWS security best practices.

The RDS DB instance must be in a private subnet to prevent direct internet access, following the defense-in-depth security principle. Only the application tier should communicate with the database over private network paths.

Placing EC2 instances in public subnets gives each instance a public IP, but Auto Scaling can assign different IPs as instances are replaced, making it impossible to maintain a stable allowlist with the external payment provider.

EC2 instances running the application logic should reside in private subnets. The ALB in public subnets handles inbound internet traffic and forwards requests to the private instances, while the NAT gateway handles outbound traffic without exposing instance IPs publicly.

An Application Load Balancer must be deployed in public subnets to receive incoming traffic from the internet. Placing the ALB in a private subnet would make the application inaccessible from the internet.