A private-only VPC with a Site-to-Site VPN is the only design that

1) gives EC2 instances L3 reachability to the on-premises subnets for data sharing,

2) prevents the instances from being reachable from (or egressing directly to) the Internet because the VPC has no internet/NAT gateway, and

3) forwards all Internet-destined traffic (0.0.0.0/0) across the VPN to the on-prem firewall, which can then reach the third-party web application.

Adding the default route to the virtual private gateway in the private-subnet route table satisfies the “all traffic to the Internet must route through the on-premises firewall” requirement.

A. NAT gateway lets instances reach the Internet directly from AWS; violates requirement to send Internet traffic through on-prem firewall.

C. Public subnets plus internet gateway expose the EC2 instances to inbound Internet access; violates “servers must not be accessible from the Internet.”

D. Private subnets lack a default (0.0.0.0/0) route to the virtual private gateway, so instances cannot reach the third-party web app; requirement unmet.

1. “Adding a route for 0.0.0.0/0 to the virtual private gateway forwards all Internet-bound traffic over the Site-to-Site VPN.” – AWS Site-to-Site VPN User Guide, Routing, Section “Add and propagate routes” (2023-10-10).

2. “Instances in a private subnet are not reachable from the Internet when the route table has no path to an internet gateway or NAT device.” – Amazon VPC User Guide, Chapter “Subnet routing,” ‘Private subnet’ example (2023-11-27).

3. AWS Whitepaper: “Hybrid Connectivity Options for Amazon VPC,” Pattern: VPN backhaul of Internet traffic, p.6–7 (2022).

4. Stanford CS244B Lecture Notes, “Enterprise VPN Design – backhauling Internet traffic,” slide 14 (2021).