Internet, NAT, and Egress Gateways

Subnets become public or private based on which gateways their traffic can reach. AWS provides several gateway types, each controlling a different direction of internet access. Understanding them lets you allow exactly the connectivity each tier needs and nothing more.

An internet gateway (IGW) is a horizontally scaled, highly available component that allows two-way communication between a VPC and the internet. A subnet with a route to the IGW is public. Resources also need a public IP or Elastic IP to be reachable from the internet through it.

A NAT (Network Address Translation) gateway lets private-subnet resources make outbound connections to the internet, for updates or API calls, while blocking inbound connections initiated from outside. It sits in a public subnet and gives private instances internet access without making them internet-reachable.

The NAT gateway is the key to the private-but-connected pattern: instances can pull patches and call external APIs yet cannot be reached from the internet. This one-way egress is exactly what application and data tiers usually need, balancing functionality with isolation.

A NAT gateway lives in a single AZ. For resilience, deploy one NAT gateway per Availability Zone and route each AZ private subnets to their local NAT. This avoids a single point of failure and keeps traffic within the AZ, improving both reliability and cost.

For IPv6, the equivalent of NAT is the egress-only internet gateway. It permits outbound IPv6 traffic from private resources while preventing the internet from initiating inbound IPv6 connections. IPv6 addresses are globally routable, so this gateway provides the outbound-only protection NAT gives for IPv4.

To reach AWS services without any internet path, use VPC endpoints. Gateway endpoints (for S3 and DynamoDB) and interface endpoints (PrivateLink) let private instances call AWS APIs over the AWS network. This keeps traffic private and can remove the need for a NAT gateway for AWS-only egress.

Every outbound path is a potential exfiltration route. Prefer VPC endpoints over NAT-to-internet for AWS services, and pair NAT with AWS Network Firewall domain filtering when broad internet egress is required. Minimizing and inspecting egress is a core hardening principle.

Match the gateway to the need: IGW for public, two-way internet; NAT for private IPv4 outbound-only; egress-only IGW for private IPv6 outbound-only; VPC endpoints for private AWS-service access. Choosing correctly is a frequent exam scenario.

NAT gateways incur hourly and data-processing charges, so routing AWS traffic through endpoints instead can cut cost and improve security at once. The most secure design is often also the leaner one: less internet exposure and fewer dollars spent moving traffic through NAT.

Gateways shape your VPC connectivity. Use an IGW only for the minimal public tier, NAT or egress-only IGW to give private tiers safe outbound access, and VPC endpoints to keep AWS traffic off the internet entirely. This controlled connectivity is central to a secure VPC.

Choose the right gateway.

An internet gateway gives public subnets two-way internet access; a NAT gateway gives private IPv4 subnets outbound-only access; an egress-only internet gateway does the same for IPv6. Deploy NAT per AZ for resilience. Use VPC endpoints (gateway and interface/PrivateLink) to reach AWS services privately, reducing both egress surface and NAT cost.