Loading…
While this loads — worth knowing
ElastiCache RedisnotElastiCache Memcached
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
Loading…
While this loads — worth knowing
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
Lets instances in private subnets connect out, while nothing outside can start a connection to them.
Where NAT Gateway takes you6 steps, all open
A NAT gateway lets instances in private subnets connect to services outside their VPC, while nothing outside can start a connection to them.
A public NAT gateway sits in a public subnet with an Elastic IP address and sends traffic out through the internet gateway. A private NAT gateway has no Elastic IP address and connects private subnets to other VPCs or your own network, through a transit gateway or a virtual private gateway.
A standard NAT gateway lives in one Availability Zone, and the exam tests what follows from that. A newer regional mode spreads one NAT gateway across the zones where your workloads run.
Staff in the back office can call anyone, and the person they call sees the company's number. Nobody outside can dial an extension directly. If the switchboard in one building fails, the staff in that building cannot call out, which is why each building has its own.
NAT gatewayPrivate IPv4Elastic IPOutboundNo unsolicited inboundZonal NAT gatewayEach zone has its own NAT gateway in its own public subnet, and each private subnet's route table sends internet traffic to the NAT gateway in the same zone. Lose a zone, and the other zone's instances keep their internet access.
One NAT gateway, shared by both zones
Private instancesServed by NAT gateway a
Private instancesServed by NAT gateway a
Click a node to make it fail.
A NAT gateway in each zone
Private instancesServed by NAT gateway a
Private instancesServed by NAT gateway b
Click a node to make it fail.
Nothing moves traffic from one zonal NAT gateway to another: each subnet's route points at one, and that is where its traffic goes.
Or use regional mode. A regional NAT gateway expands across the Availability Zones where you have workloads, with one ID for every zone and no public subnet to host it. It does not offer private NAT, and it can take up to 60 minutes to expand into a new zone; until then, that zone's traffic is handled from another zone.
No security group on the gateway. Control traffic with security groups on the instances behind it and a network ACL on its subnet. The NAT gateway uses ports 1024 to 65535, which that ACL must allow.
Connections only from inside. Nothing can start a connection through a NAT gateway to your instances. It does no port forwarding, and cannot be used as a bastion.
Not through a peering connection. Traffic cannot be routed to a NAT gateway through a VPC peering connection, so a peered VPC cannot borrow yours.
By the hour, per NAT gateway. One in each zone means paying for each.
By the gigabyte processed. Every gigabyte that goes through it is charged.
Its Elastic IP addresses are public IPv4 addresses, charged by the hour.
S3 and DynamoDB can skip it. A gateway endpoint carries that traffic at no extra charge.
Prices change, so none are printed here. Check the VPC pricing page on aws.amazon.com.
| Compare | NAT gateway | NAT instance |
|---|---|---|
| Availability | Highly available within its zone; one per zone | Your own script moves traffic between instances |
| Bandwidth | 5 Gbps, scaling to 100 Gbps | Whatever the instance type gives |
| Maintenance | Managed by AWS | You patch and update the instance |
| Security groups | Cannot have one | Can have one |
| Port forwarding | Not supported | Can be configured |
| Bastion host | Not supported | Can be used as one |
private instances need internet access that survives the loss of a zoneA NAT gateway in each zone, each private subnet routed to its own
Or one regional NAT gateway, which spreads across the zones for you.
instances in AZ b lost the internet when AZ a failedThey shared AZ a's NAT gateway
A zonal NAT gateway lives in one zone. Give each zone its own.
restrict what goes through the NAT gateway with a security groupYou cannot
Use security groups on the instances and a network ACL on the NAT gateway's subnet.
connect to private instances with SSH through the NAT gatewayNot possible: no bastion, no port forwarding
Use EC2 Instance Connect Endpoint instead.
cut NAT charges for traffic to S3A gateway endpoint for S3
It takes that traffic off the NAT gateway, at no extra charge.
IPv6 instances need outbound access onlyAn egress-only internet gateway
NAT gateways are for IPv4 traffic, or IPv6 to IPv4 with NAT64.
a peered VPC wants to use this VPC's NAT gatewayNot supported
Traffic cannot be routed to a NAT gateway through a VPC peering connection.
Application servers in private subnets in two Availability Zones call a payment provider on the internet. The provider allow-lists the IP addresses its customers call from. The design must keep working if one Availability Zone fails, and the operations team does not want servers to patch. What should a solutions architect do?
App servers in a private subnet must download operating system updates from the internet, and nothing on the internet may start a connection to them. What goes in the gap?
This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.
Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.