On this page
On this page
- What Is NAT
- What NAT Does and Does Not Do
- NAT Gateway vs. NAT Instance
- NAT Gateway Architecture
- NAT Gateway Types
- NAT Instance Configuration
- NAT vs. VPC Endpoints
- Common Routing Architecture
- Key Exam Scenarios
- CloudWatch Integration
- Automatically Published (AWS/NATGateway namespace — every 1 minute)
- Requires Setup
NAT Gateway
A NAT Gateway lets instances in private subnets make outbound connections to the internet — to download software updates, call external APIs, or reach AWS services — without being directly reachable from the internet themselves.
The Private Subnet Problem
Private subnets are private for a reason: instances there should not be directly accessible from the internet. But those instances still need to make outbound requests — a server needs to download OS patches, a Lambda function (in a VPC) needs to reach an external payment API, an EC2 instance needs to query a third-party licensing service.
Without a NAT Gateway, instances in a private subnet have no path to the internet at all. With one, they can initiate outbound connections, but no inbound connection can be established from the internet to them.
How It Works
A NAT Gateway sits in a public subnet with an Elastic IP address. When a
private-subnet instance sends traffic to the internet (say, an HTTP request to
api.example.com), the traffic goes to the NAT Gateway first. The gateway
substitutes its own public IP for the instance's private IP, forwards the request
to the internet, receives the response, and sends it back to the original
instance. From the internet's perspective, the request came from the NAT Gateway,
not the private instance.
This is a one-way door: the NAT Gateway accepts outbound connections initiated from inside, but it cannot accept inbound connections initiated from outside.
NAT Gateway vs NAT Instance
Historically, you could run a NAT Instance — a regular EC2 instance with special routing configuration. NAT Gateway replaced this with a fully managed, highly available service. NAT Gateway scales automatically, doesn't require any maintenance, and is available across multiple AZs. NAT Instances are only still relevant in edge cases: very tight cost constraints, or when you need custom port forwarding or a combined bastion/NAT host.
High Availability Consideration
A NAT Gateway is deployed into a single Availability Zone. If that AZ goes down, instances in private subnets in other AZs lose their internet path. The recommended pattern for production is to deploy one NAT Gateway per AZ and configure each AZ's private subnets to route through their own gateway.