Study guide
Technical reference and lesson notes
Purpose of This Lesson
NAT services allow resources in private subnets to initiate connections to destinations outside their subnet without exposing those resources directly to inbound internet traffic. AWS supports two primary implementations:
- NAT gateway: A managed, scalable AWS service and the preferred option for most architectures.
- NAT instance: An EC2 instance configured to perform NAT, providing flexibility but requiring substantially more operational management.
The key design decisions involve subnet placement, route tables, Elastic IP usage, high availability, and whether traffic needs public internet access or only private connectivity to other networks.
Key Concepts
Public NAT gateway placement
A NAT gateway used to provide internet access for instances in private subnets must be deployed in a public subnet. Its subnet route table must include a default route to an internet gateway, and the NAT gateway must have an Elastic IP address.
The private subnet route table then sends its default route to the NAT gateway:
Private subnet route table:
0.0.0.0/0 -> NAT gateway
Public subnet route table:
0.0.0.0/0 -> Internet gateway
The NAT gateway translates the private source addresses of the instances. External services generally see the NAT gateway’s Elastic IP as the source address. This makes it possible to allowlist one or a small number of stable public IP addresses instead of the private addresses of many application instances.
A NAT gateway in a private subnet cannot provide public internet connectivity. It has no public path through an internet gateway and therefore cannot perform this role.
NAT gateway behavior and operational model
A NAT gateway is managed by AWS. AWS handles the underlying infrastructure, maintenance, and availability within its Availability Zone. NAT gateways provide automatic scaling, with the lesson describing capacity of up to approximately 45 Gbps.
Important characteristics include:
- No security group is attached to a NAT gateway.
- It cannot be accessed through SSH.
- The Elastic IP is selected when the NAT gateway is created.
- Port forwarding is not supported.
- The NAT gateway is redundant within its Availability Zone, but it is not automatically cross-AZ resilient.
NAT instance requirements
A NAT instance is an EC2 instance configured to forward traffic. It must be deployed in a public subnet and have a public address, normally an Elastic IP. The private subnet route table sends traffic to the NAT instance.
A working NAT instance also requires:
- A suitable NAT-enabled AMI.
- Disabled source/destination checks on the EC2 instance.
- A security group that permits the required traffic.
- Operational procedures for patching, monitoring, replacement, scaling, and failover.
A NAT instance can provide capabilities that a NAT gateway does not, such as manually configured port forwarding. It can also potentially serve as a bastion host, although using a dedicated, more secure administrative access design is generally preferable.
Public and private NAT gateways
AWS provides two important NAT gateway connectivity models.
#### Public NAT gateway
A public NAT gateway allows resources in private subnets to reach the public internet. It uses an Elastic IP and is deployed in a public subnet with a route to an internet gateway.
#### Private NAT gateway
A private NAT gateway allows resources to initiate connections to private destinations, such as:
- Another VPC.
- An on-premises network.
- A network reachable through a transit gateway.
- A network reachable through a virtual private gateway.
A private NAT gateway does not use an Elastic IP. Attaching an internet gateway to the VPC does not turn a private NAT gateway into an internet NAT device. If traffic is routed from a private NAT gateway toward an internet gateway, the internet gateway drops that traffic.
High availability across Availability Zones
A NAT gateway is highly available within its own Availability Zone, but an Availability Zone failure can make that NAT gateway unavailable to resources in other zones if they depend on it.
For resilient multi-AZ designs, deploy a NAT gateway in each participating Availability Zone and configure each private subnet to use the NAT gateway in the same Availability Zone. This avoids both a single-AZ failure domain and unnecessary cross-AZ data transfer.
Each group of private subnets therefore commonly requires its own route table, or route tables associated with subnets in the same AZ:
Private subnet AZ-a -> NAT gateway AZ-a
Private subnet AZ-b -> NAT gateway AZ-b
Private subnet AZ-c -> NAT gateway AZ-c
A less resilient and potentially less expensive design can use fewer NAT gateways, but it introduces a dependency on another Availability Zone and may incur cross-AZ traffic charges. Automation can update routes after a failure, but proactive multi-AZ deployment is simpler and more robust.
Architecture Decision Guide
| Requirement | Recommended design | Reason |
|---|---|---|
| Private instances need outbound internet access | Public NAT gateway in a public subnet | Managed service with stable public egress through an Elastic IP |
| High availability across multiple AZs | One NAT gateway per AZ, with local private-subnet routes | Removes a single-AZ dependency and limits cross-AZ traffic |
| Private-to-private connectivity through network appliances or routing hubs | Private NAT gateway | Supports translation toward VPC, transit gateway, or on-premises destinations |
| Need port forwarding or custom packet-processing behavior | NAT instance | EC2-based implementation allows manual customization |
| Need minimum operational management | NAT gateway | AWS manages the underlying service |
| Need a possible bastion host combined with NAT | NAT instance, only when justified | A NAT gateway cannot be accessed through SSH, but combining roles increases risk and operational complexity |
| Very small lab or cost-sensitive environment | Evaluate a NAT instance carefully | Lower direct service cost may be offset by management, failover, and scaling requirements |
Exam-Relevant Takeaways
- A public NAT gateway must be in a public subnet, not a private subnet.
- A public NAT gateway requires an Elastic IP.
- The private subnet’s default route points to the NAT gateway, while the NAT gateway’s public subnet has a default route to the internet gateway.
- External services see the NAT gateway’s Elastic IP as the source address for outbound connections.
- NAT gateways are preferred over NAT instances for normal production requirements.
- NAT gateways are redundant within an AZ, but you need multiple NAT gateways for cross-AZ resilience.
- NAT instances require a NAT-capable AMI and disabled source/destination checks.
- NAT instances require security groups and customer-managed patching, scaling, and failover.
- Private NAT gateways are for private network destinations, not public internet access.
- A private NAT gateway cannot have an Elastic IP.
- NAT gateways do not support SSH access or port forwarding.
Common Exam Traps
Putting a public NAT gateway in a private subnet
This fails because the NAT gateway needs a path to the internet gateway. The NAT gateway’s subnet must be public, with a route to the internet gateway.
Assuming an internet gateway alone gives private instances internet access
An internet gateway does not provide source NAT for instances without public addresses. A private subnet normally needs a public NAT gateway, or another appropriate egress design.
Using one NAT gateway for every Availability Zone
A single NAT gateway can become an AZ-level failure dependency. For production high availability, use one NAT gateway per AZ and route each private subnet to its local gateway.
Choosing a NAT instance when the question emphasizes managed operations
If the scenario requires automatic scaling, managed availability, and minimal administration, NAT gateway is generally the correct answer.
Forgetting source/destination checks on NAT instances
An EC2 instance forwarding traffic must have source/destination checks disabled. Without this setting, the instance will not function correctly as a NAT device.
Assigning an Elastic IP to a private NAT gateway
Private NAT gateways do not provide internet egress and cannot be associated with Elastic IP addresses.
Expecting a NAT gateway to support inbound connections
NAT is primarily for outbound connections initiated by private resources. It is not a general inbound load balancer or port-forwarding service.
Real-World Engineer Notes
- Prefer one NAT gateway per AZ when reliability and predictable network behavior matter.
- Route private subnets to the NAT gateway in the same AZ to avoid cross-AZ dependency and data transfer costs.
- Consider VPC endpoints for AWS services such as Amazon S3 and DynamoDB. They can reduce NAT processing and data transfer costs and keep traffic on private AWS paths.
- Use centralized egress designs carefully. A central NAT or inspection VPC can simplify governance but adds routing complexity, dependency on transit infrastructure, and potentially cross-AZ traffic.
- NAT gateways do not replace egress controls. Use network ACLs, endpoint policies, DNS controls, proxy controls, and downstream firewall rules where the security design requires them.
- With NAT instances, design for failure explicitly using Auto Scaling, health checks, route updates, and replacement automation. A single EC2 NAT instance is not a highly available architecture.
- Allowlisting the NAT gateway Elastic IP is useful for partner integrations, but document ownership and replacement procedures because changing the egress address can break external access.
Quick Reference Summary
| Item | NAT gateway | NAT instance |
|---|---|---|
| AWS managed | Yes | No |
| Typical placement for internet NAT | Public subnet | Public subnet |
| Elastic IP for public internet NAT | Required | Required or public IP may be used |
| Security group | Not applicable | Required |
| Source/destination checks | Not applicable | Must be disabled |
| Automatic scaling | Yes | Customer-managed |
| AZ resilience | Redundant within one AZ | Customer-managed |
| Cross-AZ resilience | Deploy gateways in multiple AZs | Deploy and manage multiple instances |
| SSH access | No | Yes, subject to security controls |
| Port forwarding | No | Possible through customization |
| Private NAT option | Yes | Not applicable as a managed NAT gateway feature |
Flashcards
- Q: Where must a public NAT gateway be deployed?
A: In a public subnet with a route to an internet gateway.
- Q: What address does an external service normally see for traffic from private instances through a NAT gateway?
A: The NAT gateway’s Elastic IP.
- Q: What route must a private subnet use for public internet access through NAT?
A: Its default route, such as 0.0.0.0/0, points to the NAT gateway.
- Q: Does a NAT gateway need a security group?
A: No. NAT gateways do not have security groups.
- Q: What EC2 setting must be disabled on a NAT instance?
A: Source/destination checks.
- Q: Who manages patching and scaling for a NAT instance?
A: The customer.
- Q: Why deploy a NAT gateway in each AZ?
A: To avoid losing private-subnet internet access when one AZ or its NAT gateway fails and to reduce cross-AZ traffic.
- Q: Can a private NAT gateway use an Elastic IP?
A: No.
- Q: What is the purpose of a private NAT gateway?
A: Translating traffic from private resources toward private networks such as other VPCs or on-premises environments.
- Q: Can a NAT gateway be used as an SSH bastion host?
A: No. NAT gateways do not support SSH access.
- Q: Which option generally fits a managed, scalable production NAT requirement?
A: A NAT gateway.
- Q: What special AMI requirement applies to a NAT instance?
A: It must use an AMI configured to provide NAT functionality.
Practice Questions
Question 1
A company runs EC2 instances in private subnets. The instances must download updates from the public internet, and a partner will allowlist the source address. Which design meets the requirements?
A. Deploy an internet gateway in the private subnet and allowlist the instances’ private IP addresses.
B. Deploy a public NAT gateway with an Elastic IP and route the private subnet’s default traffic to it.
C. Deploy a private NAT gateway and route it to an internet gateway.
D. Deploy an internet-facing Application Load Balancer in the private subnet.
Correct answer: B
Explanation: A public NAT gateway must be in a public subnet with a route to an internet gateway. The partner sees the NAT gateway’s Elastic IP, which can be allowlisted.
Question 2
An application spans three Availability Zones. The architecture must preserve outbound internet access if any one Availability Zone fails and should avoid unnecessary cross-AZ traffic. What should the solutions architect recommend?
A. Deploy one NAT gateway in a single public subnet and use it from all private subnets.
B. Deploy one NAT instance in each private subnet without changing source/destination checks.
C. Deploy one public NAT gateway per AZ and route each AZ’s private subnets to its local gateway.
D. Deploy one private NAT gateway and attach an internet gateway to the VPC.
Correct answer: C
Explanation: NAT gateways are redundant within an AZ but are not automatically resilient across AZs. A gateway per AZ provides local, multi-AZ egress.
Question 3
A workload in a private subnet must connect to an on-premises network through a transit gateway. It must not have internet access, and no Elastic IP addresses should be used. Which service is appropriate?
A. Public NAT gateway
B. Private NAT gateway
C. Internet gateway
D. NAT instance with a public IP
Correct answer: B
Explanation: A private NAT gateway supports translation toward private networks reachable through services such as a transit gateway. It does not require or support an Elastic IP for this use case.
Question 4
A team deploys an EC2-based NAT instance in a public subnet. The instance has a suitable AMI, but private instances cannot reach external destinations. Which configuration is most likely missing?
A. An Elastic IP on every private instance
B. A route from the public subnet to a transit gateway
C. Disabled source/destination checks on the NAT instance
D. A security group attached to the internet gateway
Correct answer: C
Explanation: NAT instances must have source/destination checks disabled so they can forward traffic that is not addressed to themselves. They also require correct routes, a public path, and suitable security-group rules.
Question 5
A solutions architect is choosing between a NAT gateway and a NAT instance. The requirements are managed operations, automatic scaling, and no custom port forwarding. Which option is the best fit?
A. NAT instance, because it provides the highest level of AWS-managed availability
B. NAT gateway, because AWS manages the service and it scales automatically
C. Internet gateway, because it performs NAT for private IPv4 addresses
D. Private NAT gateway, because it provides public internet access without an Elastic IP
Correct answer: B
Explanation: NAT gateways are the preferred managed option for standard outbound internet access from private subnets. NAT instances require customer-managed maintenance, scaling, and failover, while private NAT gateways are intended for private network connectivity.