5 posts
A NAT Gateway lets Private Subnet EC2s use outbound internet (apt, external APIs) while staying secure — step-by-step creation, EIP attach, routing + a cost analysis and the NAT-instance alternative.
~20% from EC2 architecture (x86 → ARM/Graviton) alone, and up to 55% (about ₩2M/month) off by replacing ALB, NAT, and RDS with Nginx, a NAT instance, and an EC2 DB — real quotes and strategy.
When SSH-ing into EC2 you get 'WARNING: UNPROTECTED PRIVATE KEY FILE' — the .pem key's permissions are too open. Fix it instantly with chmod 400.
The Part 1 community AMI runs an old (EOS) OS and is hard to maintain. In Part 2 we build a NAT instance on the latest Ubuntu by configuring iptables directly (IP forwarding + MASQUERADE), and persist the rules across reboots.
A NAT Gateway costs $32+/month in fixed fees. To save money, I connected a Private Subnet to the internet using an EC2 NAT Instance — Part 1 uses the AWS community AMI (amzn-ami-vpc-nat).