NAT GatewayAmazon VPC NAT gateway
Lets instances in private subnets connect out, while nothing outside can start a connection to them.
Where NAT Gateway takes you6 steps, all open
- I know the problem it solves
- I can picture it
- I know how it fails
- I know when to choose it
- I can use it in a design
- I can answer an exam question
What & why
Out, but never inA NAT gateway lets instances in private subnets connect to services outside their VPC, while nothing outside can start a connection to them.
A public NAT gateway sits in a public subnet with an Elastic IP address and sends traffic out through the internet gateway. A private NAT gateway has no Elastic IP address and connects private subnets to other VPCs or your own network, through a transit gateway or a virtual private gateway.
A standard NAT gateway lives in one Availability Zone, and the exam tests what follows from that. A newer regional mode spreads one NAT gateway across the zones where your workloads run.
Reach for it when
- private instances need to download updates or call an API on the internet
- a partner allow-lists the addresses you call from: they are the NAT gateway's Elastic IP addresses
- you want nothing to patch: AWS manages it
It is the wrong tool when
- something on the internet must start the connection: that needs a public subnet or a load balancer
- IPv6 instances need to get out: that is an egress-only internet gateway
- the traffic only goes to S3 or DynamoDB: a gateway endpoint does it at no extra charge
Mental model
The switchboard for outgoing callsStaff in the back office can call anyone, and the person they call sees the company's number. Nobody outside can dial an extension directly. If the switchboard in one building fails, the staff in that building cannot call out, which is why each building has its own.
NAT gatewayPrivate IPv4Elastic IPOutboundNo unsolicited inboundZonal NAT gatewayHow it works
A request out, and its reply- Create itA public NAT gateway goes in a public subnet, with an Elastic IP address associated when it is created.
- Route to itThe private subnets' route tables send 0.0.0.0/0 to the NAT gateway.
- TranslateIt maps the instance's private address to its own; the internet gateway then maps that to the Elastic IP address.
- ReplyReplies come back through it to the instance. Nothing can start a connection the other way.
- Bandwidth
- 5 → 100 Gbpsscales automatically
- Packets
- 1 M → 10 M/sscales automatically
- Connections
- 55,000per address, to each unique destination
- Protocols
- TCP, UDP, ICMPIPv6 to IPv4 with NAT64
- Security group
- Nonecannot be attached
- Scope
- 1 AZor regional mode
Architecture
A NAT gateway in each zoneEach zone has its own NAT gateway in its own public subnet, and each private subnet's route table sends internet traffic to the NAT gateway in the same zone. Lose a zone, and the other zone's instances keep their internet access.
Failure simulation
Take a zone down, twiceOne NAT gateway, shared by both zones
AZ a
Private instancesServed by NAT gateway a
AZ b
Private instancesServed by NAT gateway a
Click a node to make it fail.
- Everything is up. Take a node or a whole zone down.
A NAT gateway in each zone
AZ a
Private instancesServed by NAT gateway a
AZ b
Private instancesServed by NAT gateway b
Click a node to make it fail.
- Everything is up. Take a node or a whole zone down.
Nothing moves traffic from one zonal NAT gateway to another: each subnet's route points at one, and that is where its traffic goes.
Or use regional mode. A regional NAT gateway expands across the Availability Zones where you have workloads, with one ID for every zone and no public subnet to host it. It does not offer private NAT, and it can take up to 60 minutes to expand into a new zone; until then, that zone's traffic is handled from another zone.
Security
What controls the trafficNo security group on the gateway. Control traffic with security groups on the instances behind it and a network ACL on its subnet. The NAT gateway uses ports 1024 to 65535, which that ACL must allow.
Connections only from inside. Nothing can start a connection through a NAT gateway to your instances. It does no port forwarding, and cannot be used as a bastion.
Not through a peering connection. Traffic cannot be routed to a NAT gateway through a VPC peering connection, so a peered VPC cannot borrow yours.
Cost
How you are charged, not what it costs todayBy the hour, per NAT gateway. One in each zone means paying for each.
By the gigabyte processed. Every gigabyte that goes through it is charged.
Its Elastic IP addresses are public IPv4 addresses, charged by the hour.
S3 and DynamoDB can skip it. A gateway endpoint carries that traffic at no extra charge.
Prices change, so none are printed here. Check the VPC pricing page on aws.amazon.com.
Comparison
NAT gateway against a NAT instance| Compare | NAT gateway | NAT instance |
|---|---|---|
| Availability | Highly available within its zone; one per zone | Your own script moves traffic between instances |
| Bandwidth | 5 Gbps, scaling to 100 Gbps | Whatever the instance type gives |
| Maintenance | Managed by AWS | You patch and update the instance |
| Security groups | Cannot have one | Can have one |
| Port forwarding | Not supported | Can be configured |
| Bastion host | Not supported | Can be used as one |
SAA traps
The phrase in the question, and what it meansprivate instances need internet access that survives the loss of a zoneA NAT gateway in each zone, each private subnet routed to its own
Or one regional NAT gateway, which spreads across the zones for you.
instances in AZ b lost the internet when AZ a failedThey shared AZ a's NAT gateway
A zonal NAT gateway lives in one zone. Give each zone its own.
restrict what goes through the NAT gateway with a security groupYou cannot
Use security groups on the instances and a network ACL on the NAT gateway's subnet.
connect to private instances with SSH through the NAT gatewayNot possible: no bastion, no port forwarding
Use EC2 Instance Connect Endpoint instead.
cut NAT charges for traffic to S3A gateway endpoint for S3
It takes that traffic off the NAT gateway, at no extra charge.
IPv6 instances need outbound access onlyAn egress-only internet gateway
NAT gateways are for IPv4 traffic, or IPv6 to IPv4 with NAT64.
a peered VPC wants to use this VPC's NAT gatewayNot supported
Traffic cannot be routed to a NAT gateway through a VPC peering connection.
Scenario
Exam style, marked when you answerApplication servers in private subnets in two Availability Zones call a payment provider on the internet. The provider allow-lists the IP addresses its customers call from. The design must keep working if one Availability Zone fails, and the operations team does not want servers to patch. What should a solutions architect do?
Practice
Fill the gap, the way the challenges workApp servers in a private subnet must download operating system updates from the internet, and nothing on the internet may start a connection to them. What goes in the gap?
Quick revision
The night before the exam- What it does
- Private instances connect out; nothing connects in.
- Public NAT
- In a public subnet, with an Elastic IP address, out through the internet gateway.
- Private NAT
- No Elastic IP address; to other VPCs or your own network.
- Per zone
- A zonal NAT gateway lives in one AZ: one per AZ, each routed within its zone.
- Regional mode
- Spreads across zones automatically; no private NAT.
- Filtering
- No security group on it: instance security groups and the subnet's network ACL.
- Cost
- By the hour and by the GB processed. S3 and DynamoDB can use a free gateway endpoint.
This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.
Checked against
Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.