VPC Gateways: Internet Gateway, NAT Gateway, and Route Table Mechanics

Internet Gateway vs NAT Gateway

| | Internet Gateway (IGW) | NAT Gateway | |---|---|---| | Direction | Bidirectional (inbound + outbound) | Outbound only | | Attached to | VPC (one per VPC) | Subnet (deployed in public subnet) | | Requires public IP on instance | Yes (Elastic IP or auto-assigned) | No — NAT handles translation | | Cost | Free | $0.045/hour + $0.045/GB processed | | Use case | Public subnets, internet-facing resources | Private subnets needing outbound internet |

Internet Gateway setup

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id
}

resource "aws_subnet" "public" {
  vpc_id                  = aws_vpc.main.id
  cidr_block              = "10.0.1.0/24"
  map_public_ip_on_launch = true   # instances get auto-assigned public IPs
}

resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id   # this makes it a public subnet
  }
}

resource "aws_route_table_association" "public" {
  subnet_id      = aws_subnet.public.id
  route_table_id = aws_route_table.public.id
}

Without map_public_ip_on_launch = true, instances in this subnet still need an Elastic IP to be reachable from the internet. Auto-assigned public IPs change on instance stop/start — use Elastic IPs for stable public addresses.

NAT Gateway: outbound internet for private subnets

# Elastic IP for the NAT Gateway
resource "aws_eip" "nat" {
  domain = "vpc"
}

# NAT Gateway deployed in the PUBLIC subnet
resource "aws_nat_gateway" "main" {
  allocation_id = aws_eip.nat.id
  subnet_id     = aws_subnet.public.id   # must be in public subnet

  depends_on = [aws_internet_gateway.main]   # IGW must exist first
}

resource "aws_subnet" "private" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.2.0/24"
  # no map_public_ip_on_launch — instances have no public IP
}

resource "aws_route_table" "private" {
  vpc_id = aws_vpc.main.id

  route {
    cidr_block     = "0.0.0.0/0"
    nat_gateway_id = aws_nat_gateway.main.id   # outbound via NAT
  }
}

resource "aws_route_table_association" "private" {
  subnet_id      = aws_subnet.private.id
  route_table_id = aws_route_table.private.id
}

Private instances make outbound connections (package downloads, API calls, ECR pulls). NAT Gateway replaces the source IP with its Elastic IP and tracks connection state to route responses back. Inbound connections initiated from the internet can't reach private instances — there's no way to address them directly.

Multi-AZ NAT Gateway pattern

A single NAT Gateway is a single point of failure and its cost is per-AZ data transfer. Production architectures deploy one NAT Gateway per AZ:

variable "azs" {
  default = ["us-east-1a", "us-east-1b", "us-east-1c"]
}

resource "aws_eip" "nat" {
  count  = length(var.azs)
  domain = "vpc"
}

resource "aws_nat_gateway" "main" {
  count         = length(var.azs)
  allocation_id = aws_eip.nat[count.index].id
  subnet_id     = aws_subnet.public[count.index].id
}

resource "aws_route_table" "private" {
  count  = length(var.azs)
  vpc_id = aws_vpc.main.id

  route {
    cidr_block     = "0.0.0.0/0"
    nat_gateway_id = aws_nat_gateway.main[count.index].id
  }
}

Each private subnet's route table points to the NAT Gateway in the same AZ. If a NAT Gateway fails (rare), only the private subnets in that AZ lose internet access — other AZs are unaffected.

resource "aws_egress_only_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id
}

# Add to private subnet route table for IPv6 outbound
resource "aws_route" "ipv6_egress" {
  route_table_id              = aws_route_table.private.id
  destination_ipv6_cidr_block = "::/0"
  egress_only_gateway_id      = aws_egress_only_internet_gateway.main.id
}