Study guide
Technical reference and lesson notes
This lesson covers how AWS provides outbound network address translation for resources in private subnets using NAT gateways and NAT instances.
For the AWS Certified Solutions Architect – Professional SAP-C02 exam, this topic matters because NAT design appears frequently in VPC architecture, hybrid networking, high availability, internet egress, security, and cost optimization scenarios. The exam expects you to know not only what a NAT gateway does, but also where it must be placed, how route tables are configured, how high availability works, and when a NAT instance is not the preferred answer.
Key Concepts
What NAT Does in an AWS VPC
Network Address Translation, or NAT, allows resources in a private subnet to initiate outbound connections while preventing unsolicited inbound connections from the internet.
A common example is an EC2 instance in a private subnet that needs to:
- Download operating system updates
- Pull packages from public repositories
- Access an external API
- Send logs or telemetry to a public endpoint
- Connect to SaaS platforms over the internet
The private instance does not have a public IP address. Instead, its traffic is routed to a NAT device. The NAT device translates the private source IP address into another source IP address that can be routed outside the private subnet.
In AWS, the two major NAT options are:
- NAT Gateway
- NAT Instance
For modern architectures and most exam scenarios, NAT Gateway is the preferred solution.
NAT Gateway Overview
A NAT gateway is a managed AWS service that provides outbound connectivity for resources in private subnets.
The most common design is:
- Private subnet resources send outbound traffic to the NAT gateway.
- The NAT gateway sits in a public subnet.
- The NAT gateway uses an Elastic IP address.
- The public subnet route table sends internet-bound traffic to an Internet Gateway.
- External services see the NAT gateway’s Elastic IP as the source address.
This allows private resources to reach the internet without exposing those private resources directly to inbound internet traffic.
Public NAT Gateway Deployment Requirements
A public NAT gateway is used when private subnet resources need outbound access to the public internet.
For this to work, the NAT gateway must meet several requirements.
Public NAT Gateway Must Be in a Public Subnet
A public NAT gateway must be deployed in a public subnet.
This is one of the biggest exam traps.
A NAT gateway used for internet access cannot sit in a private subnet because the NAT gateway itself needs a path to the internet. A public subnet is defined by having a route to an Internet Gateway.
The private subnet routes traffic to the NAT gateway, but the NAT gateway still needs to forward that traffic out to the internet. That requires the NAT gateway to be in a subnet whose route table has a default route to an Internet Gateway.
Public NAT Gateway Requires an Elastic IP Address
A public NAT gateway requires an Elastic IP address.
The Elastic IP becomes the public source address used for outbound traffic. This is important when external services need to allowlist traffic from your AWS environment.
For example, if many EC2 instances in private subnets call a third-party API, the third-party provider does not need to allowlist every private instance. They can allowlist the Elastic IP address associated with the NAT gateway.
Private Subnet Route Table Must Point to the NAT Gateway
The private subnet route table must include a route like this:
| Destination | Target |
|---|---|
| 0.0.0.0/0 | NAT Gateway |
This tells private subnet resources to send internet-bound IPv4 traffic to the NAT gateway.
The public subnet containing the NAT gateway must also have a route like this:
| Destination | Target |
|---|---|
| 0.0.0.0/0 | Internet Gateway |
Both route table paths matter.
The private subnet needs a route to the NAT gateway.
The public subnet needs a route to the Internet Gateway.
NAT Gateway Source IP Behavior
When private instances access an external service through a public NAT gateway, the external service sees the Elastic IP address of the NAT gateway as the source IP.
This is useful for controlled outbound access.
Example:
- Ten private EC2 instances access a vendor API.
- The vendor requires IP allowlisting.
- The instances route through one NAT gateway.
- The vendor only needs to allowlist the NAT gateway’s Elastic IP.
This is a common real-world pattern and a common exam concept.
NAT Gateway High Availability
NAT gateways are highly available within a single Availability Zone. AWS manages redundancy behind the scenes inside that AZ.
However, a NAT gateway is still a zonal resource in standard architectures.
That means if you deploy one NAT gateway in one Availability Zone and that AZ fails, private subnets in other AZs that depend on that NAT gateway may lose outbound internet access.
Recommended Multi-AZ NAT Gateway Design
For high availability, deploy one NAT gateway per Availability Zone and configure each private subnet to use the NAT gateway in the same AZ.
Example design:
| Availability Zone | Public Subnet | NAT Gateway | Private Subnet Route |
|---|---|---|---|
| us-east-1a | Public Subnet A | NAT Gateway A | 0.0.0.0/0 → NAT Gateway A |
| us-east-1b | Public Subnet B | NAT Gateway B | 0.0.0.0/0 → NAT Gateway B |
| us-east-1c | Public Subnet C | NAT Gateway C | 0.0.0.0/0 → NAT Gateway C |
This provides better resiliency and avoids cross-AZ dependency for outbound traffic.
Cost and Availability Tradeoff
Deploying a NAT gateway in every AZ improves availability, but it also increases cost.
A lower-cost design may use fewer NAT gateways, but this introduces risk:
- Cross-AZ routing dependency
- Potential data transfer costs
- Reduced availability during an AZ failure
- Operational complexity if route tables must be remapped during failure
For the SAP-C02 exam, the best answer usually favors high availability and correct architecture unless the question heavily emphasizes cost optimization.
NAT Gateway Scaling
NAT gateways are managed and scale automatically.
Current AWS behavior is that NAT gateways start at 5 Gbps and can automatically scale up to 100 Gbps. They also scale packet processing capacity automatically within documented limits.
Older training material may mention 45 Gbps. For current AWS references, remember the newer 100 Gbps scaling figure.
If an architecture requires more throughput than a single NAT gateway can provide, common options include:
- Deploying NAT gateways across multiple Availability Zones
- Splitting workloads across multiple private subnets
- Using separate NAT gateways per subnet or workload group
- Reducing NAT dependency through VPC endpoints where applicable
Private NAT Gateway
AWS also supports private NAT gateways.
A private NAT gateway is not used for public internet access. Instead, it allows private resources to connect to:
- Other VPCs
- On-premises networks
- Hybrid environments
- Networks connected through Transit Gateway
- Networks connected through Virtual Private Gateway
Private NAT gateways are useful when you need NAT behavior for private connectivity, such as overlapping CIDR ranges or controlled private routing.
Public NAT Gateway vs Private NAT Gateway
| Feature | Public NAT Gateway | Private NAT Gateway |
|---|---|---|
| Main purpose | Outbound internet access | Private network-to-network NAT |
| Subnet placement | Public subnet | Private subnet |
| Elastic IP required | Yes | No |
| Internet Gateway route | Yes, for internet-bound traffic | No |
| Can route to Transit Gateway | Yes | Yes |
| Can route to Virtual Private Gateway | Yes | Yes |
| Internet access | Yes | No |
| Source IP seen by destination | Elastic IP | Private IP of NAT gateway |
Private NAT Gateway Internet Gateway Gotcha
A private NAT gateway cannot be used as a workaround for internet access.
Even if the VPC has an Internet Gateway attached, traffic routed from a private NAT gateway to the Internet Gateway will be dropped.
For internet access, use a public NAT gateway in a public subnet with an Elastic IP.
For private connectivity, use a private NAT gateway with routing through Transit Gateway, Virtual Private Gateway, or other private network paths.
NAT Instance Overview
A NAT instance is an EC2 instance configured to perform NAT.
Before NAT gateways became the preferred solution, NAT instances were commonly used to provide outbound internet access from private subnets.
A NAT instance requires more manual configuration and operational responsibility than a NAT gateway.
NAT Instance Deployment Requirements
A NAT instance must usually be configured as follows:
- Launched in a public subnet
- Assigned a public IP address or Elastic IP address
- Placed in a subnet with a route to an Internet Gateway
- Referenced by the private subnet route table
- Configured using a NAT-capable AMI or manually configured NAT software
- Source/destination checks disabled
- Security group rules configured appropriately
- Operating system maintained by the customer
The private subnet route table points to the NAT instance as the target for internet-bound traffic.
Disable Source/Destination Checks for NAT Instances
EC2 instances normally perform source/destination checks.
This means AWS expects an EC2 instance to be either the source or destination of traffic that passes through it. A NAT instance forwards traffic on behalf of other instances, so it must be allowed to process traffic that is not originally sourced from or destined to itself.
For NAT instances, source/destination checks must be disabled.
If this is not done, NAT forwarding will not work correctly.
NAT Gateway vs NAT Instance
| Feature | NAT Gateway | NAT Instance |
|---|---|---|
| Management | Managed by AWS | Managed by customer |
| Availability | Redundant within an AZ | Customer must design HA |
| Scaling | Automatic | Manual instance sizing/scaling |
| Maintenance | AWS managed | Customer patches and maintains OS |
| Security groups | Not associated with security groups | Requires security group management |
| Elastic IP | Required for public NAT gateway | Optional but commonly used |
| Bastion host use | Not possible | Possible, but not recommended as a combined role |
| Port forwarding | Not supported | Possible with manual configuration |
| Exam preference | Usually correct | Usually not preferred |
| Operational burden | Low | Higher |
NAT Gateway Benefits
NAT gateways are preferred because they are:
- Managed by AWS
- Automatically scalable
- Highly available within an Availability Zone
- Easier to operate
- Better suited for production workloads
- Less prone to misconfiguration
- Not dependent on customer-managed EC2 patching or scripts
For most SAP-C02 questions, if the goal is to provide scalable, highly available outbound internet access for private subnets, the correct answer is usually NAT Gateway, not NAT Instance.
NAT Instance Use Cases
Although NAT instances are usually not the best exam answer, they still have some niche use cases.
A NAT instance may be considered when you need:
- Custom port forwarding
- Custom packet inspection
- Specialized routing behavior
- A highly customized NAT configuration
- Extremely cost-sensitive non-production workloads
- Legacy architecture support
However, using a NAT instance introduces operational responsibility. You must patch it, monitor it, size it, secure it, and design high availability yourself.
Security Considerations
NAT gateways do not allow unsolicited inbound connections from the internet to private instances. They only allow return traffic for connections initiated from inside the private subnet.
Important security points:
- NAT is not a firewall replacement.
- Use security groups and NACLs to control traffic.
- Use VPC Flow Logs for visibility.
- Use AWS Network Firewall or third-party appliances if deep packet inspection is required.
- Use VPC endpoints to avoid unnecessary internet egress for AWS service access.
- Use Elastic IP allowlisting carefully because many private resources may share the same public source IP.
Cost Considerations
NAT gateways are convenient but can become expensive in high-throughput environments.
Common NAT gateway cost drivers include:
- Hourly NAT gateway charges
- Data processing charges
- Cross-AZ data transfer if private subnets use a NAT gateway in another AZ
- Centralized egress designs that route large traffic volumes through shared NAT gateways
Cost optimization patterns include:
- Deploy NAT gateways only where needed
- Avoid routing cross-AZ unnecessarily
- Use Gateway VPC Endpoints for S3 and DynamoDB
- Use Interface VPC Endpoints for supported AWS services
- Keep private traffic private instead of sending it through public egress
- Review VPC Flow Logs to identify high-volume egress patterns
VPC Endpoints vs NAT Gateway
A NAT gateway is not always required for private resources to access AWS services.
For many AWS service calls, VPC endpoints may be a better design.
| Requirement | Better Choice | Why |
|---|---|---|
| Private instances need access to S3 | Gateway VPC Endpoint | Avoids NAT data processing charges and keeps traffic private |
| Private instances need access to DynamoDB | Gateway VPC Endpoint | Private, scalable, and cost-effective |
| Private instances need access to services like Systems Manager, CloudWatch, ECR, Secrets Manager, or STS | Interface VPC Endpoint | Keeps AWS API traffic private |
| Private instances need access to arbitrary public internet destinations | NAT Gateway | VPC endpoints only work for supported services |
| Private instances need access to third-party SaaS APIs | NAT Gateway | External public services require internet egress unless private connectivity exists |
For the exam, if the question says private instances need to access S3 or DynamoDB, look for a VPC endpoint answer before choosing NAT gateway.
Architecture Decision Guide
| Scenario | Best AWS Choice | Why |
|---|---|---|
| Private EC2 instances need outbound internet access | Public NAT Gateway | Managed, scalable, and designed for outbound internet egress |
| Private EC2 instances need to be reachable from the internet | Not NAT Gateway; use ALB/NLB, public subnet, or other inbound design | NAT gateway does not allow unsolicited inbound internet traffic |
| Private subnet resources need to access a vendor API with IP allowlisting | Public NAT Gateway with Elastic IP | Vendor can allowlist the NAT gateway Elastic IP |
| Highly available production VPC across multiple AZs | NAT Gateway per AZ | Avoids single-AZ dependency and improves resiliency |
| Cost-sensitive development environment | Single NAT Gateway or NAT Instance, depending on requirements | Lower cost may be acceptable if availability requirements are low |
| Private instances need S3 access | Gateway VPC Endpoint | Avoids NAT and keeps traffic on AWS private network paths |
| Private instances need AWS API access without internet | Interface VPC Endpoint | Provides private connectivity to supported AWS services |
| Need custom port forwarding or specialized NAT behavior | NAT Instance | NAT gateways do not support port forwarding |
| Need outbound connectivity to on-premises through private routing | Private NAT Gateway | Supports private NAT through Transit Gateway or Virtual Private Gateway |
| Need internet access using private NAT gateway | Incorrect design | Private NAT gateway traffic to Internet Gateway is dropped |
Exam-Relevant Takeaways
For SAP-C02, remember these points:
- A public NAT gateway must be placed in a public subnet.
- A public NAT gateway requires an Elastic IP address.
- Private subnet route tables point internet-bound traffic to the NAT gateway.
- The public subnet route table must route internet-bound traffic to an Internet Gateway.
- External services see the NAT gateway’s Elastic IP as the source address.
- NAT gateways are managed by AWS and preferred over NAT instances.
- NAT gateways are highly available within an Availability Zone.
- For multi-AZ resiliency, deploy one NAT gateway per AZ.
- NAT instances require manual management and source/destination checks must be disabled.
- NAT instances can support custom behavior such as port forwarding, but they are rarely the best exam answer.
- Private NAT gateways are for private connectivity, not internet access.
- VPC endpoints may be better than NAT gateways for accessing AWS services privately.
- NAT gateways support outbound-initiated connections, not unsolicited inbound internet connections.
Common Exam Traps
Trap 1: Placing a Public NAT Gateway in a Private Subnet
A NAT gateway used for internet access must be in a public subnet.
If an answer says to deploy the NAT gateway in a private subnet for internet access, it is wrong.
Trap 2: Forgetting the Elastic IP
A public NAT gateway requires an Elastic IP address.
The Elastic IP is also the address that external services see as the source IP.
Trap 3: Assuming One NAT Gateway Is Highly Available Across AZs
A NAT gateway is highly available within an AZ, but standard NAT gateways are still zonal resources.
For multi-AZ resiliency, deploy NAT gateways in multiple AZs and point each private subnet to the local NAT gateway.
Trap 4: Choosing NAT Instance for a Managed Production Design
NAT instances are customer-managed. They require patching, scaling, security group configuration, and high availability design.
If the question asks for a managed, scalable, highly available solution, NAT Gateway is almost always better.
Trap 5: Using NAT Gateway for Inbound Access
NAT gateways do not allow unsolicited inbound connections from the internet.
If private instances need to serve inbound traffic, use a load balancer, public-facing architecture, PrivateLink, VPN, Direct Connect, or another appropriate design.
Trap 6: Ignoring VPC Endpoints
If the scenario involves private resources accessing AWS services such as S3, DynamoDB, Systems Manager, ECR, CloudWatch, Secrets Manager, or STS, check whether a VPC endpoint is the better answer.
The exam may include NAT gateway as a distractor when the better answer is a VPC endpoint.
Trap 7: Trying to Use a Private NAT Gateway for Internet Access
Private NAT gateways are for private routing to other VPCs or on-premises networks.
They are not used for public internet egress.
Real-World Engineer Notes
In real environments, NAT gateway design affects cost, resiliency, security, and troubleshooting.
For production workloads, the cleanest architecture is usually one NAT gateway per AZ, with each private subnet routing to the NAT gateway in the same AZ. This avoids cross-AZ egress dependency and reduces the blast radius of an AZ failure.
From an operations perspective, NAT gateways are much easier than NAT instances. A NAT instance is just another server you have to patch, monitor, harden, and recover during failure. It may be useful for a lab or specialized routing scenario, but it is usually technical debt in production.
Cost is the main reason engineers sometimes hesitate to deploy multiple NAT gateways. NAT gateway hourly charges and data processing charges can add up. Before blindly routing everything through NAT, review whether traffic can use VPC endpoints instead. S3, DynamoDB, Systems Manager, ECR, CloudWatch, STS, and Secrets Manager traffic can often be moved away from NAT-based internet egress.
For troubleshooting, check route tables first. A NAT design usually fails because of one of these issues:
- NAT gateway placed in the wrong subnet
- Public subnet missing route to Internet Gateway
- Private subnet missing default route to NAT gateway
- Security group or NACL blocking traffic
- NAT instance source/destination checks still enabled
- Workload in one AZ routing through a failed or unavailable NAT gateway in another AZ
- External vendor has not allowlisted the NAT gateway Elastic IP
Also remember that NAT centralizes outbound identity. That is useful for allowlisting, but it can also hide which internal workload generated traffic unless you have good logging. Use VPC Flow Logs, application logs, firewall logs, and cloud-native monitoring to preserve visibility.
Quick Reference Summary
- NAT Gateway is the preferred managed AWS solution for outbound internet access from private subnets.
- A public NAT gateway must be in a public subnet and requires an Elastic IP.
- Private subnet route tables send
0.0.0.0/0traffic to the NAT gateway. - Public subnet route tables send
0.0.0.0/0traffic to the Internet Gateway. - External systems see the NAT gateway’s Elastic IP as the source address.
- NAT gateways are highly available within an AZ.
- Use one NAT gateway per AZ for resilient multi-AZ architecture.
- NAT instances are EC2-based, customer-managed, and require source/destination checks to be disabled.
- NAT instances are usually not the best exam answer unless custom NAT behavior is required.
- Private NAT gateways support private connectivity to other VPCs or on-premises networks, not public internet access.
- Use VPC endpoints instead of NAT gateways when private resources need access to supported AWS services.
Flashcards
Q: What is the main purpose of a NAT gateway?
A: To allow resources in private subnets to initiate outbound connections while preventing unsolicited inbound internet connections.
Q: Where must a public NAT gateway be deployed?
A: In a public subnet.
Q: Why must a public NAT gateway be in a public subnet?
A: It needs a route to an Internet Gateway so it can forward outbound traffic to the internet.
Q: What public IP address does an external service see when private instances use a public NAT gateway?
A: The Elastic IP address associated with the NAT gateway.
Q: What route should a private subnet use for outbound internet access through NAT?
A: A default route, usually 0.0.0.0/0, pointing to the NAT gateway.
Q: What route must the NAT gateway’s public subnet have?
A: A default route to the Internet Gateway.
Q: Is a NAT gateway associated with security groups?
A: No. NAT gateways do not use security groups.
Q: What must be disabled on a NAT instance?
A: Source/destination checks.
Q: Why are NAT gateways preferred over NAT instances?
A: NAT gateways are managed, scalable, and highly available within an AZ, while NAT instances require customer management.
Q: When might a NAT instance be considered?
A: When custom NAT behavior, port forwarding, or specialized routing is required.
Q: How do you design NAT gateway high availability across multiple AZs?
A: Deploy one NAT gateway per AZ and route each private subnet to the NAT gateway in the same AZ.
Q: Can a private NAT gateway provide public internet access?
A: No. A private NAT gateway is for private connectivity to other VPCs or on-premises networks.
Q: What is often a better choice than NAT gateway for private access to S3?
A: A Gateway VPC Endpoint for S3.
Q: What is a common NAT gateway cost optimization strategy?
A: Use VPC endpoints for supported AWS services to reduce NAT data processing and internet egress dependency.
Q: Does NAT gateway allow inbound connections initiated from the internet?
A: No. It supports outbound-initiated connections and return traffic only.
Practice Questions
Question 1:
A company has EC2 instances in private subnets that need to download software updates from the internet. The solution must be managed by AWS and highly available within each Availability Zone. What should the architect deploy?
A. NAT instances in private subnets
B. NAT gateways in public subnets
C. Internet Gateways attached directly to the private subnets
D. Bastion hosts in public subnets
Correct Answer:
B. NAT gateways in public subnets
Explanation:
A NAT gateway in a public subnet allows private subnet instances to initiate outbound internet connections. NAT gateways are managed by AWS and are preferred over NAT instances for scalable production designs.
Question 2:
A third-party API provider requires a company to provide a small number of public IP addresses for allowlisting. The company has many EC2 instances in private subnets that need to call the API. Which design should be used?
A. Assign public IP addresses to all private EC2 instances
B. Route the private instances through a public NAT gateway with an Elastic IP
C. Use a private NAT gateway and route traffic to an Internet Gateway
D. Use VPC peering to connect to the API provider over the internet
Correct Answer:
B. Route the private instances through a public NAT gateway with an Elastic IP
Explanation:
When private instances access the internet through a public NAT gateway, external services see the NAT gateway’s Elastic IP as the source address. This allows the provider to allowlist a small number of IPs.
Question 3:
An engineer deployed a NAT instance in a public subnet and updated the private subnet route table to point to the instance. Private instances still cannot access the internet. What configuration step is commonly missed?
A. Enable source/destination checks on the NAT instance
B. Disable source/destination checks on the NAT instance
C. Remove the Elastic IP from the NAT instance
D. Move the NAT instance to a private subnet
Correct Answer:
B. Disable source/destination checks on the NAT instance
Explanation:
A NAT instance forwards traffic for other instances. EC2 source/destination checks must be disabled so the instance can process traffic that is not originally sourced from or destined to itself.
Question 4:
A company has a three-AZ VPC. Each AZ has public and private subnets. The company wants highly available outbound internet access for private workloads while avoiding cross-AZ dependency. Which design is best?
A. Deploy one NAT gateway in a single public subnet and route all private subnets to it
B. Deploy one NAT gateway per public subnet in each AZ and route each private subnet to the NAT gateway in the same AZ
C. Deploy one NAT instance in a private subnet and route all traffic through it
D. Attach an Internet Gateway to each private subnet
Correct Answer:
B. Deploy one NAT gateway per public subnet in each AZ and route each private subnet to the NAT gateway in the same AZ
Explanation:
NAT gateways are highly available within an AZ. For multi-AZ resilience, deploy NAT gateways in multiple AZs and route each private subnet to the local NAT gateway.
Question 5:
Private EC2 instances need to access Amazon S3 without sending traffic through the public internet or incurring NAT gateway data processing charges. What is the best solution?
A. Public NAT Gateway
B. NAT Instance
C. Gateway VPC Endpoint for S3
D. Internet Gateway
Correct Answer:
C. Gateway VPC Endpoint for S3
Explanation:
For private access to S3, a Gateway VPC Endpoint is usually the best design. It avoids NAT gateway dependency and keeps traffic on AWS private network paths.