Skip to content

NatGateway

Source: src/AWS/EC2/NatGateway.ts

A NAT gateway that lets instances in a private subnet reach the internet (and other AWS services) while preventing unsolicited inbound connections.

The gateway lives in the subnet given by subnetId, and its connectivityType decides how it connects: a "public" gateway must sit in a public subnet and requires an Elastic IP via allocationId, while a "private" gateway has no public address and is used for VPC-to-VPC routing. A NAT gateway only carries traffic once a Route sends 0.0.0.0/0 from the private subnet’s route table to it. Core properties (subnetId, connectivityType, allocationId) are immutable, so changing them replaces the gateway.

Public NAT Gateways

Section titled “Public NAT Gateways”

Public gateways translate private addresses to a stable public IP, so they must be placed in a public subnet (one with a route to an internet gateway) and given an Elastic IP allocation.

const eip = yield* AWS.EC2.EIP("NatEip", {});


const natGateway = yield* AWS.EC2.NatGateway("NatGateway", {
  subnetId: publicSubnet.subnetId,
  allocationId: eip.allocationId,
  connectivityType: "public",
  tags: { Name: "production-nat" },
});

Allocating the EIP first and passing its allocationId gives the gateway a fixed public IP. connectivityType defaults to "public", so it can be omitted; this is the standard way to give private instances outbound internet access.

Private NAT Gateways

Section titled “Private NAT Gateways”

Private gateways have no public IP and route traffic between VPCs or to on-premises networks without exposing it to the internet.

Private NAT Gateway with a Fixed Private IP

const natGateway = yield* AWS.EC2.NatGateway("PrivateNat", {
  subnetId: privateSubnet.subnetId,
  connectivityType: "private",
  privateIpAddress: "10.0.10.10",
});

Omitting allocationId and setting connectivityType: "private" creates a gateway with no public address; privateIpAddress pins it to a specific address in the subnet instead of letting AWS choose one automatically.

Private NAT Gateway with Secondary Addresses

const natGateway = yield* AWS.EC2.NatGateway("ScaledNat", {
  subnetId: privateSubnet.subnetId,
  connectivityType: "private",
  secondaryPrivateIpAddressCount: 3,
});

Secondary private addresses — via secondaryPrivateIpAddressCount, secondaryPrivateIpAddresses, or secondaryAllocationIds — raise the number of simultaneous connections a private gateway can sustain to busy destinations, which is only valid for private gateways.

Routing Private Traffic

Section titled “Routing Private Traffic”
const natRoute = yield* AWS.EC2.Route("NatRoute", {
  routeTableId: privateRouteTable.routeTableId,
  destinationCidrBlock: "0.0.0.0/0",
  natGatewayId: natGateway.natGatewayId,
});

Without a route the gateway is inert; this entry sends all outbound traffic from the private subnet’s route table through the gateway so private instances can reach the internet.