I am trying to setup a highly available AWS Magento deployment. There is a reference deployment here: http://docs.aws.amazon.com/quickstart/latest/magento/architecture.html
Based on this, I want to build my own and I like his idea where only the NAT instances are in the public subnet.
The RDS instances and the webservers are both behind the NAT in the private subnets. I find this a departure from most of my understanding so far which was that the webserver had to be in the public subnet to be able to be accessible from the Internet.
What I am missing is how to configure the NAT instance running in the public subnet to port-forward port 80/443 to the corresponding webserver behind the NAT in the private subnet. I don't believe this can be done through Security Groups on the NAT instance alone.