15

On AWS, let's say I have 3 private subnets in 3 different AZs and I want all of them to be able to access the internet through a NAT gateway. AWS guides suggest having separate NAT gateways and bastion hosts for each subnet (assuming they're needed of course). Needless to mention, everything is in the same VPC (and consequently the same region).

Is there going to be a performance penalty for sharing the same NAT gateway for all private subnets?

lfk
  • 2,423
  • 6
  • 29
  • 46

1 Answers1

25

The performance penalty for traffic going between AZs is minor (single-digit millisecond latency).

The real reason for using multiple NAT Gateways is for high-availability.

If there is a single NAT Gateway and that AZ should fail, then all private instances would lose Internet access. Having a NAT Gateway in each AZ ensures high availability.

If you are not too concerned about a potentially rare occurrence, you can save money by using only one NAT Gateway.

(A NAT Gateway is redundant within a single AZ.)

Dzhuneyt
  • 8,437
  • 14
  • 64
  • 118
John Rotenstein
  • 241,921
  • 22
  • 380
  • 470
  • 7
    Looking at VPC pricing, one NAT gateway per AZ could also be more cost effective (depending on the use case): "There will be data transfer charge between your NAT Gateway and EC2 instance if they are in the different availability zone" – lfk Jan 25 '19 at 04:51