A VPC currently uses IPv4 only with public and private subnets, NAT gateways, route tables, and ACLs already configured. The VPC is assigned an IPv6 CIDR, subnet IPv6 addresses are added, routes updated, and ACLs changed to permit IPv6. Public subnets can access the internet over IPv6, but private subnets cannot initiate IPv6 outbound connections. What should the SysOps administrator do to provide outbound-only IPv6 internet access from the private subnets?

To enable outbound-only IPv6 internet access for instances in private subnets, an Egress-Only Internet Gateway (EIGW) is required. Unlike an Internet Gateway (IGW) which allows both inbound and outbound IPv6 traffic, an EIGW specifically prevents unsolicited inbound connections while permitting outbound ones. After creating and attaching the EIGW to the VPC, a default route (::/0) must be added to the private subnets' route tables, pointing to the newly created EIGW. Enabling IPv6 NAT on existing NAT gateways is incorrect because NAT gateways are designed for IPv4 traffic and do not support IPv6. Provisioning a dedicated IPv6-only NAT gateway is not a standard AWS service; Egress-Only Internet Gateways fulfill this role for IPv6. Adding a default route to the existing internet gateway would allow inbound IPv6 traffic, which is not desired for private subnets.