NAT Gateway

Understand NAT Gateway for private subnet outbound internet access, including cost, AZ placement, routing, and alternatives.

Last reviewed: June 2026

·AWS CloudAWS CLI v2AWS SDKsAWS Well-Architected Framework
✅
Quick Understanding: NAT Gateway helps teams design, build, secure, operate, and troubleshoot AWS workloads. In enterprise projects, the important questions are ownership, blast radius, automation, observability, compliance, and cost.

🔍 What Is It?

A NAT Gateway lets resources in private subnets initiate outbound internet connections without allowing unsolicited inbound internet connections.

It is commonly used for package downloads, external APIs, patches, and SaaS integrations from private workloads.

🎯 Why Do We Need It?

Private application servers often need outbound access but should not be directly reachable from the internet.

NAT Gateway supports that pattern by translating private addresses to a public address for outbound traffic.

Common developer mistakes:

  • →Choosing defaults without checking security, cost, or failure behavior
  • →Treating AWS services as isolated tools instead of part of an architecture
  • →Skipping tags, alarms, IAM review, backups, and runbooks until production incidents happen
  • →Building manually in the console and then struggling to reproduce environments

🏗️ What Happens in Real Projects?

Application instances in private subnets route 0.0.0.0/0 to a NAT Gateway in the same AZ. The NAT Gateway sits in a public subnet with an Elastic IP.

Enterprises often reduce NAT usage by adding VPC endpoints for AWS services such as S3, ECR, CloudWatch, and Secrets Manager.

⚙️ How It Works

A private subnet route table points internet-bound traffic to a NAT Gateway. The NAT Gateway forwards traffic through the public subnet's internet gateway and tracks connection state for return traffic.

NAT Gateway is AZ-scoped, so resilient designs place one NAT Gateway per AZ and route private subnets to the local NAT.

💻 Example

NAT route design — Private subnet outbound routing with AZ alignment.

text
app-subnet-a route:
  0.0.0.0/0 -> nat-gateway-a

app-subnet-b route:
  0.0.0.0/0 -> nat-gateway-b

Public NAT subnets:
  nat-gateway-a -> internet gateway
  nat-gateway-b -> internet gateway

Cost optimization:
  Add S3/ECR/CloudWatch VPC endpoints where useful

🤔 Common Confusions

❓ Does NAT Gateway allow inbound internet traffic?

No. It supports outbound connections initiated by private resources.

❓ Is NAT Gateway free?

No. It has hourly and data processing charges, so architecture should watch usage.

❓ Do I need NAT to reach S3?

Not necessarily. You can use an S3 VPC endpoint to avoid routing S3 traffic through NAT.

🚨 Common Production Issues

**Single NAT Gateway** creates AZ dependency or outage impact.

**Unexpected NAT cost** from high-volume AWS service or data transfer traffic.

**Wrong route table** leaves private instances without outbound access.

**Using NAT for everything** ignores cheaper and more private VPC endpoint options.

✅ Best Practices

Use one NAT Gateway per AZ for critical multi-AZ workloads

Route private subnets to the NAT Gateway in the same AZ

Use VPC endpoints for common AWS service traffic

Monitor NAT bytes, errors, and cost

Avoid placing application servers in public subnets just for outbound access

Document which workloads require internet egress

🏛️ Architect's Note

Senior Architect's Perspective

NAT Gateway is convenient, reliable, and easy to forget on the bill. Good architects design egress intentionally: what needs internet, what can use private endpoints, and what should be blocked entirely.

💬 Frequently Asked Questions

Interview: How would you explain NAT Gateway in a real AWS project?

NAT Gateway should be explained through the business workload it supports, the AWS responsibility boundary, the failure modes, the security controls, and how it is monitored and automated.

Interview: What production mistake do developers commonly make with NAT Gateway?

The common mistake is using the service successfully in a lab but not designing for least privilege, multi-AZ resilience, alarms, cost visibility, and repeatable infrastructure.

Can NAT Gateway be used for inbound access?

No. Use a load balancer, API Gateway, VPN, or other ingress pattern for inbound traffic.

What is the alternative to NAT Gateway?

For AWS service access, VPC endpoints are often better. For controlled external access, some enterprises use proxies or egress firewalls.

🎯 Key Takeaways

1NAT Gateway enables private subnet outbound internet
2It does not allow unsolicited inbound traffic
3AZ placement matters for resilience
4VPC endpoints can reduce cost and improve privacy

🎯 Practice this topic in interviews

↗ Where this topic fits

Sources

Sources / References

Use these AWS references to verify the concept in official docs and continue into the most relevant SplashRide pages.