AWS NAT Gateway

An AWS NAT Gateway is a managed service that allows instances in a private subnet to connect to the Internet while keeping them secure. The NAT Gateway acts as an intermediary for outbound traffic, providing a controlled and secure way for private instances to access the internet without exposing their private IP addresses.

NAT, or Network Address Translation, is a method used to modify network address information in packet headers while in transit. It is commonly employed to allow multiple devices in a private network to share a single public IP address for internet communication.

AWS employs a NAT Gateway to enable instances in a private subnet to connect to the internet for software updates or other external services, while still maintaining a level of security.

AWS private subnets are used to enhance security by isolating resources from direct exposure to the internet. In a private subnet, instances have no public IP addresses, making them less susceptible to unauthorized access. This setup is particularly useful for hosting databases or backend services that don’t require direct internet access but still need to communicate with resources in other subnets or the internet through controlled gateways like NAT.

The following diagram from the AWS with Terraform: The Essential Guide tutorial shows a NAT Gateway providing Internet connectivity to the VPC private subnets.

A NAT Gateway is created in a public subnet and uses an Elastic IP as its public address. It is the target of the route table of the private subnets for traffic destined for public IP addresses, which enables resources within a private subnet, with no public IP, to initiate outbound connections to the Internet. Connections initiated from the Internet are not allowed.

For the NAT Gateway to route traffic, it has to be used as a routing destination (0.0.0.0/0) in the route table of the private subnets.

Create a NAT gateway in each Availability Zone to ensure zone-independent architecture.

Pricing #

A NAT Gateway is billed per hour while it exists plus per GB of data processed, which makes it one of the first costs of a small AWS environment. For tests, destroy it when it is not needed, or use a NAT instance or VPC endpoints for AWS services such as S3 to reduce the traffic. See the VPC pricing.

With Terraform #

The resources are aws_nat_gateway and aws_eip, plus an aws_route in each private route table.

See tutorials using a NAT Gateway:

• AWS with Terraform: The Essential Guide (7/21) – AWS NAT Gateway
• Terraform, AWS, and Ansible together
• How to Deploy Containers in AWS ECS with Terraform and Fargate