Cloud NAT Gateway

Definition

A cloud NAT (Network Address Translation) gateway is a managed service that lets resources in a private subnet initiate outbound connections to the internet — for software updates, API calls, or package downloads — while preventing any inbound connections from the internet from reaching them directly.

Overview

Resources in a private subnet, by design, have no public IP address and no direct route from the internet — that's the point of putting them there. But those resources often still need outbound internet access: an application server pulling OS security patches, a service calling a third-party API, or a container pulling a base image from a public registry. A NAT gateway solves this asymmetric need by acting as a managed intermediary: private resources route their outbound traffic through the NAT gateway, which itself sits in a public subnet with a public (or elastic) IP, translates the private resource's source IP to its own public IP for outbound requests, and forwards return traffic back to the originating private resource — while never allowing a connection to be initiated from the internet inbound. This is functionally similar to how a home router lets multiple devices on a private local network share one public IP to reach the internet, but implemented as a managed, highly available cloud service rather than a single device. Cloud providers (AWS NAT Gateway, GCP Cloud NAT, Azure NAT Gateway) handle the scaling, redundancy, and bandwidth of the NAT function, removing the operational burden of running and patching a self-managed NAT instance, which was the older pattern before managed NAT gateways existed. NAT gateways are typically deployed per availability zone (to avoid a cross-AZ single point of failure and cross-AZ data transfer charges) and are billed on both an hourly rate and per-gigabyte of data processed, which can become a meaningful cost line for services with high outbound data volume — a common cost-optimization exercise is auditing what's actually being pulled through a NAT gateway and whether it could instead go through a cheaper, more direct path like a VPC endpoint for supported AWS services. NAT gateways are a standard, near-universal component of any VPC architecture that includes private subnets needing any form of outbound internet reachability.

Key Features

• Allows outbound-only internet access for resources in private subnets
• Blocks all inbound connections initiated from the internet by design
• Managed, highly available service — no self-managed NAT instance to patch or scale
• Translates private resource IPs to the NAT gateway's public IP for outbound requests
• Typically deployed per availability zone to avoid cross-AZ dependency and transfer costs
• Billed on hourly usage plus per-gigabyte data processing charges
• Commonly used for OS patching, third-party API calls, and container image pulls from private subnets
• Can often be bypassed for specific AWS/GCP/Azure services using VPC endpoints/private service connect for cost savings

Use Cases

Alternatives

Frequently Asked Questions

Related in Cloud