What Is a NAT Gateway and When Do You Need One?
Learn what an AWS NAT gateway does, how it enables outbound-only internet access for private subnets, and when you need one for a secure VPC design.
Expected Interview Answer
A NAT gateway is a managed AWS service that lets instances in a private subnet initiate outbound connections to the internet, such as downloading updates, while blocking unsolicited inbound connections from reaching them.
Placed in a public subnet with an Elastic IP, a NAT gateway translates the private IP addresses of instances in a private subnet to its own public address for outbound traffic, then routes replies back to the originating instance. Because it only permits connections initiated from inside the VPC, external hosts cannot open new connections into the private subnet, preserving isolation. AWS manages the gateway's availability and bandwidth scaling, unlike a self-managed NAT instance on EC2, which you would have to patch, size, and fail over yourself. NAT gateways are typically deployed per Availability Zone for resilience and billed by the hour plus data processed.
- Lets private subnet resources reach the internet for patches and API calls
- Blocks unsolicited inbound connections, preserving subnet isolation
- Fully managed by AWS with built-in high availability within an AZ
- Scales bandwidth automatically without capacity planning
- Removes the operational burden of a self-managed NAT instance
AI Mentor Explanation
A NAT gateway is like the team manager who is the only one allowed to step outside the dressing room to collect equipment from suppliers, then bring it back inside. Suppliers can respond to the manager's requests, but they can never walk into the dressing room uninvited, so the players stay reachable only through that one trusted, outward-facing gatekeeper.
Step-by-Step Explanation
Step 1
Deploy in a public subnet
A NAT gateway sits in a public subnet and is assigned an Elastic IP so it can reach the internet gateway.
Step 2
Update the private subnet's route table
Point 0.0.0.0/0 traffic from the private subnet to the NAT gateway instead of an internet gateway.
Step 3
Outbound-only translation
The NAT gateway translates private instance addresses to its own public IP for outbound requests and routes responses back.
Step 4
No unsolicited inbound access
External hosts cannot initiate new connections into the private subnet through the NAT gateway.
Step 5
Deploy per Availability Zone
Use one NAT gateway per AZ so a zone failure doesn't cut off outbound access for instances in other zones.
What Interviewer Expects
- Explains that NAT gateways enable outbound-only internet access for private subnets
- Distinguishes a NAT gateway from an internet gateway
- Knows it's a managed, highly available AWS service versus a self-managed NAT instance
- Mentions per-AZ deployment for resilience
- Understands billing is hourly plus data processed
Common Mistakes
- Confusing a NAT gateway with an internet gateway
- Assuming one NAT gateway covers all Availability Zones with equal resilience
- Believing a NAT gateway allows inbound connections from the internet
- Not accounting for NAT gateway data processing costs in cost estimates
Best Answer (HR Friendly)
“A NAT gateway lets private, protected servers reach out to the internet — say, to download a software update — without ever letting anyone from the internet reach back into them. It's a one-way door that AWS fully manages for you.”
Code Example
resource "aws_eip" "nat" {
domain = "vpc"
}
resource "aws_nat_gateway" "nat" {
allocation_id = aws_eip.nat.id
subnet_id = aws_subnet.public.id
}
resource "aws_route" "private_egress" {
route_table_id = aws_route_table.private.id
destination_cidr_block = "0.0.0.0/0"
nat_gateway_id = aws_nat_gateway.nat.id
}Follow-up Questions
- How is a NAT gateway different from a NAT instance?
- Why would you deploy a NAT gateway in every Availability Zone?
- What costs are associated with a NAT gateway?
- How does a NAT gateway interact with security groups and NACLs?
- Can a NAT gateway be shared across multiple private subnets?
MCQ Practice
1. What is the primary purpose of a NAT gateway?
A NAT gateway enables private subnet resources to initiate outbound connections while blocking unsolicited inbound ones.
2. Where must a NAT gateway be deployed?
A NAT gateway needs a public subnet and Elastic IP so it can route through the internet gateway.
3. Why deploy one NAT gateway per Availability Zone?
Per-AZ NAT gateways avoid cross-AZ charges and prevent one zone's outage from cutting off other zones' outbound access.
Flash Cards
What does a NAT gateway allow? — Outbound-only internet access from private subnet resources, blocking unsolicited inbound traffic.
Where does a NAT gateway live? — In a public subnet, with an assigned Elastic IP.
NAT gateway vs NAT instance? — A NAT gateway is fully managed and highly available; a NAT instance is a self-managed EC2 instance you patch and scale yourself.
Why one NAT gateway per AZ? — To avoid cross-AZ data charges and prevent a zone outage from blocking outbound access elsewhere.