NAT Gateway
The one-way egress door that lets a private-subnet tier reach the internet without letting the internet reach back in. Here's what NAT Gateway is for, what it costs, how it connects to your private compute, and the mistakes Design Beaver catches as you draw.
What NAT Gateway is
A NAT gateway is a managed AWS service that lets resources in a private subnet reach the internet and public AWS service endpoints for outbound traffic, while blocking any connection the internet tries to start inbound. Private-subnet compute — EC2 instances, VPC-attached Lambda functions — routes its outbound traffic through the gateway, which swaps the private source address for its own so responses find their way back. It’s the standard egress path for a private tier that needs to pull packages, call third-party APIs, or reach AWS public APIs without holding a public IP of its own.
Design Beaver models a NAT gateway as a subnet-resident VPC resource — a public one has to sit inside a public subnet — and validates as you draw where it belongs and which private-subnet resources can route through it.
When to use NAT Gateway (and when not to)
Reach for a NAT gateway when private-subnet resources need to initiate outbound connections to the internet or public AWS APIs but must never accept inbound connections. It fits when you want a managed NAT that AWS operates and scales, rather than patching a self-managed NAT instance on EC2, and when your outbound destinations are varied and arbitrary — many external hosts that per-service endpoints wouldn’t cover.
Don’t reach for it when the only outbound destinations are S3 or DynamoDB — a gateway VPC endpoint reaches those privately with no per-GB or hourly charge. Skip it, too, when the only destinations are a handful of AWS services like SQS, SNS, or SES that each have an interface VPC endpoint, since PrivateLink keeps that traffic on the AWS backbone. And if the resource actually needs to receive inbound connections from the internet, that’s an internet-facing load balancer or a public subnet — a NAT gateway is outbound-only.
Variants: connectivity type, not instance size
A NAT gateway’s real choice is connectivity type — public or private — plus a newer regional availability mode. There are no instance sizes to pick; AWS scales bandwidth for you.
| Option | What it is |
|---|---|
| Public NAT gatewaydefault | Created in a public subnet with an Elastic IP that must be associated at creation. Translates private-subnet source addresses so traffic can egress to the internet via the VPC's internet gateway. The default and most common type. |
| Private NAT gateway | Has no Elastic IP and no internet path. Used for outbound connectivity to other VPCs or an on-premises network through a Transit Gateway or virtual private gateway, keeping traffic off the public internet. |
| Regional availability mode | Newer mode (GA Nov 2025) where the NAT gateway automatically expands across Availability Zones based on where workloads run, billed per AZ. Reduces the operational overhead of manually running one gateway per AZ and can remove the need for dedicated public subnets. |
NAT Gateway pricing
You pay an hourly rate for each gateway provisioned plus a per-GB charge on everything it processes — and for a chatty private tier, the per-GB data-processing charge is often the bigger line item than the hourly rate.
Pay an hourly rate for each NAT gateway provisioned and available (each partial hour billed as a full hour), plus a per-GB data-processing charge on all traffic that passes through it — both dimensions are billed regardless of whether the destination is the internet or an AWS service, and standard data-transfer charges still apply on top. Running one NAT gateway per AZ (the resilient pattern) multiplies the hourly charge by the number of AZs. Traffic to S3/DynamoDB via a gateway endpoint avoids both the per-GB and hourly charge.
| Option | Representative rate |
|---|---|
| public | ~$0.045 per NAT gateway-hour plus ~$0.045 per GB processed (confirmed against aws.amazon.com/vpc/pricing/, us-east-1) |
| regional | ~$0.045 per GB processed, plus ~$0.045 per hour per AZ the regional gateway is active in (per aws.amazon.com/vpc/pricing/, us-east-1) |
Keeping the bill down
- Add gateway VPC endpoints for S3 and DynamoDB so that high-volume traffic bypasses the NAT gateway's per-GB data-processing charge
- Keep egress in-AZ (one NAT gateway per AZ, routed same-AZ) to avoid inter-AZ data-transfer charges on top of the NAT processing fee
- Consolidate outbound-heavy workloads and watch per-GB processing cost — a chatty private tier can make data processing, not the hourly rate, the dominant line item
us-east-1 (rates vary by region). Rates as of 2026-07. Verify at the official pricing page before using for real cost estimates — this list is not kept in sync with AWS pricing changes.
How NAT Gateway connects to other services
A NAT gateway isn’t a data-path endpoint other services call — it’s an egress path, and the detail that makes it work lives in the route tables around it. Design Beaver models each edge, so it knows what routes through the gateway and what each connection needs to be correct.
- Internet
A public NAT gateway forwards outbound traffic from private-subnet resources to the internet (via the VPC's internet gateway) and returns the responses, while dropping any connection the internet tries to initiate inbound
EC2 instances in a private subnet reach the internet or public AWS APIs for outbound-only traffic by routing 0.0.0.0/0 through the NAT gateway, without any instance holding a public IP
A VPC-attached Lambda function in a private subnet uses the NAT gateway for outbound internet / public-AWS-API access (e.g. calling a third-party API) it otherwise couldn't reach from inside the VPC
What NAT Gateway can’t connect to
Some edges look reasonable on a canvas but aren’t real AWS integrations. Design Beaver flags them instead of letting you draw a diagram that can’t be built.
A NAT gateway is an outbound egress path to the internet and public endpoints, not something a database is placed behind. EC2/Lambda reach RDS directly over the VPC's private network (same-VPC routing plus security groups); RDS traffic never transits a NAT gateway.
Anti-patterns Design Beaver catches
These are the NAT gateway mistakes that pass a diagram review but bite in production — the ones the validation engine flags as you draw.
A single NAT gateway shared by private subnets across multiple Availability Zones
Why it breaksThe NAT gateway is a single-AZ resource (redundant only within its own AZ) — if its AZ has an outage, every private subnet routed to it, including those in healthy AZs, loses outbound connectivity, and traffic hairpinning into the gateway's AZ incurs inter-AZ data-transfer charges
Do this insteadDeploy one NAT gateway per Availability Zone and point each private subnet's route table at the NAT gateway in its own AZ (or use the regional availability mode)
Routing all S3 and DynamoDB traffic from a private subnet through a NAT gateway
Why it breaksNAT gateways bill per hour and per GB processed; sending high-volume S3/DynamoDB traffic through one incurs data-processing charges for traffic that could stay on the AWS backbone for free
Do this insteadAdd a gateway VPC endpoint for S3 and DynamoDB so that traffic bypasses the NAT gateway entirely — gateway endpoints have no hourly or data-processing charge
Placing a public NAT gateway in a private subnet
Why it breaksA public NAT gateway needs a route to an internet gateway to reach the internet; in a private subnet it has no internet path and can't perform its function
Do this insteadPut the public NAT gateway in a public subnet with an Elastic IP, and route private subnets' 0.0.0.0/0 to it
Gotchas that bite in production
- It’s outbound only. A NAT gateway never lets the internet start a connection inward. Don’t reach for it when you actually need to receive traffic — that’s a public subnet or load balancer.
- Placement and the Elastic IP are strict. A public NAT gateway must live in a public subnet with a route to an internet gateway, and it needs an Elastic IP associated at creation. A private NAT gateway can’t take an Elastic IP at all.
- The routing lives in the private subnets, not on the gateway. Each private subnet’s route table needs a
0.0.0.0/0route targeting the NAT gateway. A missing route is the usual “why isn’t my instance reaching the internet” cause. - A single gateway is a single-AZ resource. Share one across AZs and an outage in its AZ takes down egress for every subnet routed to it — plus you pay inter-AZ data transfer in the meantime. Run one per AZ, routed same-AZ, or use the regional availability mode.
Further reading
Frequently asked questions
When should you use a NAT gateway?
What is the difference between a public and a private NAT gateway?
How much does a NAT gateway cost?
Can a NAT gateway connect to RDS?
Do you need one NAT gateway per Availability Zone?
Validate your NAT Gateway architecture as you draw
Design Beaver checks your AWS design in real time — missing queues, invalid connections, and security anti-patterns, caught before you ship. It’s live in beta, free, and runs in your browser with no account.
Open the app →Prefer email? Get new features in your inbox: