Centralized Internet Egress with NAT Gateway
Publication date: October 20, 2021 (Diagram history)
This architecture uses NAT Gateway and AWS Transit Gateway to create a highly available centralized internet egress for all Amazon VPCs while isolating inter-VPC traffic.
Centralized Internet Egress with NAT Gateway architecture
The following steps describe the data flow in this architecture:
-
Traffic from the Amazon Elastic Compute Cloud instance in the workload subnet reaches the internet. The subnet route table routes to AWS Transit Gateway through the default route (0.0.0.0/0).
-
Traffic enters AWS Transit Gateway on the VPC-Transit Gateway attachment. The Transit Gateway route table routes the traffic to the egress VPC through the default route.
-
Traffic enters the egress VPC on the Transit Gateway attachment subnet. This subnet route table routes the traffic to the NAT Gateway in that Availability Zone through the default route.
-
Traffic enters the NAT Gateway, and the source IP changes to the NAT Gateway IP.
-
When exiting the NAT Gateway, the traffic looks up the public subnet route table and routes to the internet gateway.
-
The traffic leaves for the internet.
Further reading
For additional information, see the following resources:
Diagram history
To be notified about updates to this reference architecture diagram, subscribe to the RSS feed.
| Change | Description | Date |
|---|---|---|
Initial publication | Reference architecture diagram first published. | October 20, 2021 |
Note
To subscribe to RSS updates, you must have an RSS plugin enabled for the browser you are using.
