How do I configure an AWS EC2 NAT Gateway?

In this guide, we are going to configure an AWS EC2 NAT Gateway. A NAT Gateway allows instances in a private subnet to connect to the internet or other AWS services, but prevents the Internet from initiating connections with those instances. This is commonly used for security reasons, ensuring that only outbound connections are allowed from private instances.

Key Resources:

VPC: The Virtual Private Cloud in which your resources are deployed.
Subnet: A segment of your VPC’s IP address range where you can place groups of isolated resources.
Internet Gateway: Allows instances in the VPC to access the internet.
Route Table: Contains a set of rules, called routes, that are used to determine where network traffic is directed.
Elastic IP: A static IPv4 address designed for dynamic cloud computing.
NAT Gateway: Enables instances in a private subnet to initiate outbound traffic to the internet, but prevent the internet from initiating connections with the instances.

Below, we provide a complete example:

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const config = new pulumi.Config();
const vpcCidr = config.get("vpcCidr") || "10.0.0.0/16";
const publicSubnetCidr = config.get("publicSubnetCidr") || "10.0.1.0/24";
const privateSubnetCidr = config.get("privateSubnetCidr") || "10.0.2.0/24";
// Create a VPC
const myVpc = new aws.ec2.Vpc("my_vpc", {
    cidrBlock: vpcCidr,
    tags: {
        Name: "my_vpc",
    },
});
// Create a public subnet
const publicSubnet = new aws.ec2.Subnet("public_subnet", {
    vpcId: myVpc.id,
    cidrBlock: publicSubnetCidr,
    tags: {
        Name: "public_subnet",
    },
});
// Create an internet gateway
const myIgw = new aws.ec2.InternetGateway("my_igw", {
    vpcId: myVpc.id,
    tags: {
        Name: "my_igw",
    },
});
// Create a route table for the public subnet
const publicRt = new aws.ec2.RouteTable("public_rt", {
    vpcId: myVpc.id,
    routes: [{
        cidrBlock: "0.0.0.0/0",
        gatewayId: myIgw.id,
    }],
    tags: {
        Name: "public_rt",
    },
});
// Associate route table with the public subnet
const publicRtAssoc = new aws.ec2.RouteTableAssociation("public_rt_assoc", {
    subnetId: publicSubnet.id,
    routeTableId: publicRt.id,
});
// Create an elastic IP for the NAT Gateway
const natEip = new aws.ec2.Eip("nat_eip", {vpc: true});
// Create the NAT Gateway
const myNatGateway = new aws.ec2.NatGateway("my_nat_gateway", {
    allocationId: natEip.id,
    subnetId: publicSubnet.id,
    tags: {
        Name: "my_nat_gateway",
    },
});
// Create a private subnet
const privateSubnet = new aws.ec2.Subnet("private_subnet", {
    vpcId: myVpc.id,
    cidrBlock: privateSubnetCidr,
    tags: {
        Name: "private_subnet",
    },
});
// Create a route table for the private subnet
const privateRt = new aws.ec2.RouteTable("private_rt", {
    vpcId: myVpc.id,
    routes: [{
        cidrBlock: "0.0.0.0/0",
        natGatewayId: myNatGateway.id,
    }],
    tags: {
        Name: "private_rt",
    },
});
// Associate route table with the private subnet
const privateRtAssoc = new aws.ec2.RouteTableAssociation("private_rt_assoc", {
    subnetId: privateSubnet.id,
    routeTableId: privateRt.id,
});
export const vpcId = myVpc.id;
export const publicSubnetId = publicSubnet.id;
export const privateSubnetId = privateSubnet.id;
export const natGatewayId = myNatGateway.id;
export const natGatewayAllocationId = natEip.id;

Key Points:

VPC and Subnets: We created a VPC and divided it into one public and one private subnet.
Internet Gateway: Serves as a gateway for the VPC to access the internet.
Route Tables: Configured to direct traffic appropriately for the public and private subnets.
NAT Gateway: Implemented within the public subnet, enabling instances in the private subnet to connect to the internet.

Conclusion

In this example, we created an AWS EC2 NAT Gateway within a VPC, including the necessary subnets, route tables, and internet gateway. This setup ensures instances in the private subnet can access the internet securely.

Deploy this code

Want to deploy this code? Sign up for a free Pulumi account to deploy in a few clicks.

New to Pulumi?

Want to deploy this code? Sign up with Pulumi to deploy in a few clicks.