title: “VPC NAT Gateway” created: 2026-07-22 updated: 2026-07-22 type: knowledge tags:

aws
certification
networking
vpc

VPC NAT Gateway

What It Is

A NAT Gateway is an AWS-managed Network Address Translation service that enables resources in a private subnet to initiate outbound connections to the Internet while preventing the Internet from initiating inbound connections to those resources.

Why It Matters

Private subnets need Internet access for tasks like downloading patches, calling external APIs, or reaching AWS service endpoints. The NAT Gateway provides this without exposing the resources publicly. This is a core pattern for secure VPC architectures.

Key Concepts

How It Works

Private Instance → Private Subnet Route Table → NAT Gateway (in public subnet) → IGW → Internet

Instance in private subnet sends traffic to the Internet
Route table sends 0.0.0.0/0 traffic to the NAT Gateway
NAT Gateway translates the private IP to its own Elastic IP
Traffic exits through the Internet Gateway
Response follows the reverse path

Characteristics

AWS-managed — no patching, no maintenance
Outbound-only — Internet cannot initiate connections to private resources
Lives in a public subnet (needs IGW access itself)
Has an Elastic IP (static public IP for outbound traffic)
Scales automatically up to 100 Gbps
Supports TCP, UDP, and ICMP

Deployment Options

Option	Description	Use Case
Zonal (1 AZ)	One NAT GW in one public subnet	Cost-effective for single-AZ apps
Multi-AZ	One NAT GW per AZ	High availability for production

NAT Gateway vs NAT Instance

Aspect	NAT Gateway	NAT Instance
Management	AWS-managed	Self-managed EC2
Availability	Built-in HA within AZ	Must configure yourself
Bandwidth	Up to 100 Gbps	Depends on instance type
Cost	Per-hour + per-GB	Instance cost only
Security groups	Not supported	Supported

Cost Considerations

NAT Gateways are billed for:

Hourly charge (per NAT Gateway)
Data processing (per GB of traffic)

This can become expensive with high data transfer volumes.

Gotchas

A NAT Gateway is AZ-specific — if the AZ goes down, so does the NAT Gateway
For HA, deploy one NAT Gateway per AZ with each private subnet routing to its own
NAT Gateways cannot be used by resources in the same subnet they live in
You cannot associate a security group with a NAT Gateway (use NACLs instead)
NAT Gateway needs an Elastic IP — there’s a limit of 5 EIPs per Region (soft limit)

AWS Certification Notes