# AWS NAT Gateway

> An AWS NAT Gateway is a managed service that allows instances in a private subnet to connect to the Internet while keeping them secure.

- Source: https://www.itwonderlab.com/aws-nat-gateway/
- Published: 2024-01-22
- Updated: 2026-10-05
- Author: Javier Ruiz Jiménez (https://www.javierruizjimenez.com/)
- Site: IT Wonder Lab (https://www.itwonderlab.com/)

---

![AWS NAT GW](https://www.itwonderlab.com/media/logos/Others/AWS_NAT_GW.svg)

An AWS NAT Gateway is a managed service that allows instances in a private [subnet](https://www.itwonderlab.com/aws-subnets/) to connect to the Internet while keeping them secure. The NAT Gateway acts as an intermediary for outbound traffic, providing a controlled and secure way for private instances to access the internet without exposing their private IP addresses.

NAT, or Network Address Translation, is a method used to modify network address information in packet headers while in transit. It is commonly employed to allow multiple devices in a private network to share a single public IP address for internet communication.

AWS employs a NAT Gateway to enable instances in a private subnet to connect to the internet for software updates or other external services, while still maintaining a level of security.

AWS private subnets are used to enhance security by isolating resources from direct exposure to the internet. In a private subnet, instances have no public IP addresses, making them less susceptible to unauthorized access. This setup is particularly useful for hosting databases or backend services that don’t require direct internet access but still need to communicate with resources in other subnets or the internet through controlled gateways like NAT.

The following diagram from the [AWS with Terraform: The Essential Guide](https://www.itwonderlab.com/tag/aws-terraform-essential-guide/) tutorial shows a NAT Gateway providing Internet connectivity to the VPC private subnets.

![AWS Internet Gateway and NAT Gateway Routing](https://www.itwonderlab.com/media/tutorials/AWS-Terraform-Essentials/ITWL-Tutorials-AWS-Terraform-Essentials-Routing_8.svg)

A NAT Gateway is created in a **public** subnet and uses an [Elastic IP](https://www.itwonderlab.com/aws-elastic-ip/) as its public address. It is the target of the [route table](https://www.itwonderlab.com/aws-route-tables/) of the private subnets for traffic destined for public IP addresses, which enables resources within a private subnet, with no public IP, to initiate outbound connections to the Internet. Connections initiated from the Internet are not allowed.

For the NAT Gateway to route traffic, it has to be used as a routing destination (`0.0.0.0/0`) in the route table of the private subnets.

Create a NAT gateway **in each [Availability Zone](https://www.itwonderlab.com/aws-regions-availability-zones/)** to ensure zone-independent architecture.

### Pricing

A NAT Gateway is billed per hour while it exists plus per GB of data processed, which makes it one of the first costs of a small AWS environment. For tests, destroy it when it is not needed, or use a NAT instance or VPC endpoints for AWS services such as S3 to reduce the traffic. See the [VPC pricing](https://aws.amazon.com/vpc/pricing/).

### With Terraform

The resources are `aws_nat_gateway` and `aws_eip`, plus an `aws_route` in each private route table.

See tutorials using a NAT Gateway:

-   [AWS with Terraform: The Essential Guide (7/21) – AWS NAT Gateway](https://www.itwonderlab.com/aws-terraform-tutorial-aws-nat-gateway/)
-   [Terraform, AWS, and Ansible together](https://www.itwonderlab.com/terraform-aws-ansible/)
-   [How to Deploy Containers in AWS ECS with Terraform and Fargate](https://www.itwonderlab.com/containers-aws-ecs-terraform-fargate/)