NAT Gateways and Internet Access from a VPC
Learn why a Lambda inside a private VPC subnet loses internet access and how NAT gateways and VPC endpoints restore connectivity securely.
NAT Gateways and Internet Access from a VPC is a free Serverless AWS Lambda Development lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Serverless AWS Lambda Development learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
The Surprise
A Lambda in a VPC can reach private resources, but it loses default internet access. Calls to public APIs suddenly time out.
Why It Happens
VPC Lambdas have no public IP. Without a route to the internet, outbound calls to external endpoints have nowhere to go.
Public vs Private Subnets
A public subnet routes to an Internet Gateway; a private subnet does not. Always place Lambdas in private subnets for security.
Enter the NAT Gateway
A NAT gateway lives in a public subnet and lets private subnets make outbound internet calls while staying unreachable from the internet.
The Route Table
The private subnet route table sends internet-bound traffic to the NAT gateway, which forwards it through the Internet Gateway.
Destination Target
10.0.0.0/16 local
0.0.0.0/0 nat-0abc123NAT Costs Money
NAT gateways charge per hour plus per GB processed. For heavy traffic this adds up, so consider whether you truly need public internet access.
VPC Endpoints Instead
To reach AWS services like S3 or DynamoDB, use a VPC endpoint. Traffic stays on the AWS network with no NAT needed and no per-GB internet cost.
Gateway vs Interface Endpoints
S3 and DynamoDB use free gateway endpoints; most other services use interface endpoints (powered by PrivateLink) which are billed hourly.
Calling S3 Through an Endpoint
No code change is needed. With a gateway endpoint and the right route, this S3 call never leaves the AWS backbone.
import boto3
s3 = boto3.client('s3')
s3.put_object(Bucket='my-bucket', Key='log.txt', Body=b'hi')Choosing the Right Path
Need a public third-party API? Use a NAT gateway. Need only AWS services? Use VPC endpoints. Often you use endpoints to avoid NAT entirely.
Multi-AZ for Resilience
Deploy a NAT gateway per Availability Zone and put the Lambda in multiple subnets, so one AZ outage does not break connectivity.
Quick Check
Test your VPC networking knowledge.
Recap
You learned why VPC Lambdas lose internet access and how NAT gateways restore outbound access, while VPC endpoints reach AWS services privately and cheaply.
Frequently asked questions
Is the “NAT Gateways and Internet Access from a VPC” lesson free?
Yes — the full text of “NAT Gateways and Internet Access from a VPC” is free to read here on the web, and the Serverless AWS Lambda Development course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Serverless AWS Lambda Development course, upgrade to CoddyKit PRO.
What will I learn in “NAT Gateways and Internet Access from a VPC”?
Learn why a Lambda inside a private VPC subnet loses internet access and how NAT gateways and VPC endpoints restore connectivity securely. You practise Serverless AWS Lambda Development with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Serverless AWS Lambda Development?
No prior experience is required. Serverless AWS Lambda Development on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “NAT Gateways and Internet Access from a VPC” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Serverless AWS Lambda Development lesson?
Yes. Every Serverless AWS Lambda Development lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Lambda in a VPC for Private Resources
- Accessing Databases in VPC
- Network Security Best Practices
- NAT Gateways and Internet Access from a VPC