Studying/Notes/AWS/Networking and Content Delivery/Amazon VPC/NAT GatewayNAT Gateway What it is A managed Network Address Translation service that lets resources in a private subnet reach out to the internet (or other AWS services) while staying unreachable from the internet. How it works Sits in a public subnet with an Elastic IP. Private subnet’s route table sends 0.0.0.0/0 to the NAT Gateway, which then forwards via the Internet Gateway (IGW). Why Private instances can download patches/updates and call external APIs without ever accepting inbound connections. Operational notes Managed, auto-scales, AZ-scoped — deploy one per AZ for high availability. Charged per hour and per GB processed. Not to be confused with NAT instance — the old self-managed EC2-based alternative; NAT Gateway is the managed replacement. Internet Gateway (IGW) — two-way internet for public subnets. NAT Gateway is outbound-only for private ones.