Skip to main content
Cloud & AI Hub
Browse
Glossary AI Directory Playgrounds Models Prompts Explainers Strategy Matrix Benchmark Decoder
Networking

NAT Gateway

Managed outbound-only internet access for private subnets — and the quietly notorious line item on cloud bills, at $0.045 per gigabyte processed.

What is a NAT gateway?

A NAT gateway lets instances in private subnets initiate outbound internet connections — pulling packages, calling APIs, downloading container images — while accepting no unsolicited inbound traffic. It performs source-address translation: private IPs leave stamped with the gateway’s Elastic IP, replies flow back through the established connection state. It’s the standard answer to “private tier needs the internet, the internet must not reach the private tier.”

The bill nobody budgets

NAT pricing is ~0.045/hour∗plus 0.045/hour *plus ~0.045 per GB processed*, and the per-GB half is the famous trap: every S3 download, ECR image pull, and third-party API call from private subnets pays it. Teams discover four-figure monthly NAT charges from container pulls alone. The fixes are well-trodden — VPC gateway endpoints for S3/DynamoDB (free, bypass NAT entirely), interface endpoints for high-volume AWS services, ECR pull-through caches — and routinely cut NAT data processing 80–95%. Auditing NAT flow logs for top talkers is among the highest-ROI hours in cloud cost work.

Placement and resilience

A NAT gateway lives in one AZ. The resilient pattern is one per AZ, with each private subnet routing to its local gateway — otherwise an AZ outage takes down outbound connectivity for every zone, and cross-AZ NAT traffic adds transfer charges on top. It scales automatically to tens of Gbps, but has connection-count limits per destination that bulk scrapers and mass-parallel workloads can hit.

What people get wrong

  • NAT in a private subnet — it must sit in a public subnet with an internet gateway route, or nothing flows.
  • One NAT for the whole VPC as a cost saving that becomes an availability and transfer-cost mistake.
  • Using NAT for AWS-service traffic that endpoints would carry free.

Primary source: AWS VPC documentation — NAT gateways

Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.