We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design Masterclass · Cloud Infrastructure
Free preview: the first 2 parts of this 7-part lesson.
Already bought the course? Sign in to read the whole lesson.
this lesson is part of
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design courseread the rest of this lesson in
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design coursein Cloud Infrastructure
This lesson is part of the full System Design Masterclass. Unlock it along with 769 other lessons for a one-time payment.
One-time payment by card or PayPal
Get Lifetime AccessOne-time payment: UPI, card or netbanking
Get Lifetime Access18 Foundation lessons are free, no payment needed. Try them now
It is easy and good
“It is really nice and good Please join the course”
You've put your database in a private subnet. Good. No public IP, no route to the Internet Gateway. It's invisible to the outside world. Secure.
But then you try to run apt update to patch a vulnerability. It fails. You try to download a dependency from npm. Fails. You try to send logs to Datadog. Fails. Your instance is so isolated that it can't even help itself.
Private instances need outbound internet access for legitimate reasons, software updates, pulling container images, calling external APIs, sending telemetry. A NAT Gateway provides exactly this: outbound access without inbound exposure. Your instance can reach out to the internet, but nothing on the internet can reach in.
Think of it like a one-way mirror. You can see out. Nobody can see in.
| Feature | Internet Gateway | NAT Gateway |
|---|---|---|
| Direction | Bidirectional (in + out) | Outbound only |
| Subnet type | Public subnets | Serves private subnets |
| IP mapping | 1:1 (instance public IP) | Many:1 (PAT) |
| Cost | Free | ~$32/month + $0.045/GB |
| Managed by | AWS (fully automatic) | AWS (you provision it) |
| Placement | Attached to VPC | Lives in a public subnet |
Setup pattern:
0.0.0.0/0 -> nat-gw-xxxHigh availability: A NAT Gateway runs in a single AZ. If that AZ goes down, private instances in other AZs lose internet access. For production, deploy one NAT Gateway per AZ, this doubles or triples the cost, but prevents a single-AZ failure from breaking outbound connectivity everywhere.