Start with the destination
Do not add a NAT gateway automatically whenever a private workload cannot connect. General internet access and third-party APIs usually require outbound internet connectivity. Supported AWS services can often be reached privately with a VPC endpoint. Public resources require an internet gateway plus correct routing and addressing.
Internet gateway
Connects a VPC to the internet. A public subnet routes to it; an IPv4 instance also needs a public IPv4 address or Elastic IP.
NAT gateway
Lets private workloads initiate external connections without accepting unsolicited inbound connections.
VPC endpoint
Provides private access to supported services without requiring internet or NAT for that traffic.
Read route tables like a packet
A public IPv4 subnet commonly sends its default route to an attached internet gateway. The instance also needs a public address.
Public subnet 10.0.0.0/16 → local 0.0.0.0/0 → igw-...
A private subnet sends general outbound IPv4 traffic to a public NAT gateway. The NAT gateway resides in a public subnet whose default route points to the internet gateway.
Private subnet: 0.0.0.0/0 → nat-... NAT public subnet: 0.0.0.0/0 → igw-...
An S3 or DynamoDB gateway endpoint adds service-prefix routes to selected route tables, so matching service traffic avoids the NAT path.
Architecture scenarios
Private EC2 instances only need S3
Choose an S3 gateway endpoint. Associate the private route tables and restrict access using IAM, endpoint and bucket policies. This keeps the path private and avoids NAT processing for S3 traffic.
Private servers need vendor updates
Choose a public NAT gateway for outbound IPv4 internet access. Place it in a public subnet, attach an Elastic IP and plan availability per Availability Zone.
Private workloads call a supported AWS API
Evaluate an interface endpoint. Confirm service support, endpoint subnets, private DNS, endpoint security groups and endpoint policy.
Troubleshooting checklist
- Resolve: verify DNS and the actual destination IP.
- Route: identify the associated route table and longest-prefix match.
- Inspect: check IGW attachment, NAT state and placement, or endpoint state and associations.
- Authorize: verify security groups, network ACLs, IAM, endpoint and resource policies.
- Observe: use VPC Flow Logs, service logs and NAT metrics before changing controls.
Fast decision rule
Direct public connectivity: internet gateway. Private workload needs general outbound internet: NAT gateway. Private workload needs a supported AWS service: evaluate a VPC endpoint first.
Official AWS references
Frequently asked questions
Does a private subnet need a NAT gateway to access Amazon S3?
Not necessarily. An S3 gateway VPC endpoint can provide private S3 access through associated route tables without using a NAT gateway for that traffic.
Where should a public NAT gateway be created?
Create it in a public subnet, associate an Elastic IP, and route that subnet to an internet gateway. Private subnets route outbound IPv4 traffic to the NAT gateway.
When should I use an interface VPC endpoint?
Use one for private access to a supported service through endpoint network interfaces. Verify private DNS, security groups and the endpoint policy.