NAT Gateway Flashcards
NAT Instances
NAT Instance or NAT Gateway?
NAT Gateway always, unless you have a specific reason
NAT Instances
Why never use NAT Instances?
Old version of Amazon Linux; not specialized for high throughput networking
NAT Instances
How do you control what traffic can use a NAT Instance?
Security Groups and NACLs, just like anything else
NAT Instances
How can you use a NAT Instance to throttle performance?
Deliberately pick small instance size
NAT Instances
Are NAT Instances HA?
Not by default
NAT Instances
How can you make a NAT Instance HA?
important
Scripts that monitor instances and change routes when one fails
NAT Instances
How can you save money with a NAT Instance?
important
Use it for port forwarding and as a bastion host
NAT Instances
Can you use a NAT Instance across VPC Peers?
Yes, it’s just an EC2 instance
NAT Instances
Can you use a NAT Instance across S2S VPN?
Yes, it’s just an EC2 instance
NAT Instances
Can you use a NAT Instance across Direct Connect?
Yes, it’s just an EC2 instance
NAT Gateway
What’s the cross-AZ best practice for NATGW?
Use separate NATGW in each AZ
NAT Gateway
Why is this the best practice?
If AZ fails, other AZs aren’t affected
NAT Gateway
What’s the cost implication?
Multi-AZ NATGW means inter-AZ traffic charges.
NAT Gateway
How do I set up a NAT Gateway in my application’s subnet?
Can’t. NATGW need route table entries to direct traffic to it, so has to be separate Subnets.
NAT Gateway
What is the tiering/subnet rule when you add NAT Gateways?
Can’t have a NAT Gateway in the same subnet as a thing that uses it: need routing between subnets
NAT Gateway
Limit on NAT GW throughput?
important
Up to 45 Gbps
NAT Gateway
What do you do if you need more than 45 Gbps through a NAT GW?
important
Add more NAT GWs and more routes
NAT Gateway
How do you change IP addresses used by NAT GWs?
important
Absolutely can’t: create a new NATGW.
NAT Gateway
Can you use a NATGW across VPC Peers?
No
NAT Gateway
Can you use a NATGW across S2S VPN?
No
NAT Gateway
Can you use a NATGW across Direct Connect?
No
NAT Gateway
Access S3: cheaper with NATGW or gateway endpoint?
important
Gateway endpoint (free)
NAT Gateway
How do you control what traffic can use a NATGW?
important
NACLs (can use SG on private subnets)
NAT Gateway
Can you use Security Groups to secure a NAT GW?
important
No, not on the NAT GW itself
