7 posts
A NAT Gateway lets Private Subnet EC2s use outbound internet (apt, external APIs) while staying secure — step-by-step creation, EIP attach, routing + a cost analysis and the NAT-instance alternative.
~20% from EC2 architecture (x86 → ARM/Graviton) alone, and up to 55% (about ₩2M/month) off by replacing ALB, NAT, and RDS with Nginx, a NAT instance, and an EC2 DB — real quotes and strategy.
When SSH-ing into EC2 you get 'WARNING: UNPROTECTED PRIVATE KEY FILE' — the .pem key's permissions are too open. Fix it instantly with chmod 400.
Install Nginx on a cloud server like AWS EC2 — version-specific installs on Ubuntu (apt) and CentOS (yum), the /etc/nginx config structure (sites-available/enabled), and firewalls (UFW, firewalld, AWS security groups) all in one.
For Oracle folks moving to MS SQL Server, the confusing 3-level Login·User·Schema structure compared with Oracle's 1-level (User=Schema=Login) model — including the sysadmin-locked-to-dbo problem and the per-task account separation fix.
The Part 1 community AMI runs an old (EOS) OS and is hard to maintain. In Part 2 we build a NAT instance on the latest Ubuntu by configuring iptables directly (IP forwarding + MASQUERADE), and persist the rules across reboots.
A NAT Gateway costs $32+/month in fixed fees. To save money, I connected a Private Subnet to the internet using an EC2 NAT Instance — Part 1 uses the AWS community AMI (amzn-ami-vpc-nat).