NAT gateway

Lets things in private subnets reach out to the internet, while nothing can reach in.

Think of it as: A one-way turnstile at the gate. Staff can go out, strangers can't walk in.

What to know for Level 0

A NAT gateway sits in a public subnet, and the private subnets' route tables send 0.0.0.0/0 to it. Things in private subnets can then call out, while nothing can call in.
A VPC-attached Lambda function, or a Fargate task or EC2 instance in a private subnet, needs a NAT gateway (or a VPC endpoint) to reach the internet or public AWS services like SQS. Without one, calls time out.

More detail

A NAT gateway sits in a public subnet. Private subnets send their internet-bound traffic to it, and it forwards that traffic out through the internet gateway. Lambda functions attached to a VPC need one (or VPC endpoints) to call AWS services like SQS. It’s charged per hour and per GB, which is why VPC endpoints are often the cheaper, more private choice.

Quiz yourself on NAT gateway →

← All terms