NAT Gateways & Bastion Hosts

Learn about NAT Gateways for outbound internet access and Bastion Hosts for secure access to private instances.

nat-bastion-config.json
{
"SubnetId": "subnet-123456",
"AllocationId": "eipalloc-123456"
}
nat-bastion-config.json
1 / 13
🌐

Tutor:NAT Gateways and Bastion Hosts are essential components for secure VPC architectures. NAT Gateways enable outbound internet access for instances in private subnets, while Bastion Hosts provide secure access to private instances.


VPC Security Mastery

Unlock nodes by learning new VPC security concepts.

Concept 1: VPC Security Basics

NAT Gateways and Bastion Hosts are essential components for secure VPC architectures. NAT Gateways enable outbound internet access for instances in private subnets, while Bastion Hosts provide secure access to private instances.

System Check

What is the main purpose of a NAT Gateway?

Community Holo-Net

Showcase Your VPC Security Configurations

Built secure VPC setups? Share your NAT Gateway and Bastion Host configurations.

Support Us

NAT Gateways & Bastion Hosts

Author

Pascual Vila

Cloud Instructor.

NAT Gateways and Bastion Hosts are essential components for secure VPC architectures. NAT Gateways enable outbound internet access for instances in private subnets, while Bastion Hosts provide secure access to private instances.

NAT Gateways

A NAT Gateway is a managed Network Address Translation service that allows instances in private subnets to access the internet for updates, downloads, or outbound connections, while preventing inbound internet access. NAT Gateways are highly available and automatically scale.

Bastion Hosts

A Bastion Host is a special-purpose EC2 instance in a public subnet that acts as a secure gateway to access instances in private subnets. You SSH into the bastion host first, then from there access your private instances. This eliminates the need to expose private instances directly to the internet.

Best Practices

Use NAT Gateways for outbound internet access from private subnets, use Bastion Hosts for secure access to private instances, implement proper security groups, and consider using AWS Systems Manager Session Manager as an alternative to SSH.

NAT & Bastion Glossary

NAT Gateway
A managed Network Address Translation service that allows instances in private subnets to access the internet for outbound connections, while preventing inbound internet access. Highly available and automatically scales.
Bastion Host
A special-purpose EC2 instance in a public subnet that acts as a secure gateway to access instances in private subnets. You SSH into the bastion host first, then from there access your private instances.
NAT Instance
An alternative to NAT Gateways, but not recommended for production. NAT Instances are single EC2 instances that you manage yourself, while NAT Gateways are fully managed and highly available.
Elastic IP
A static public IP address required for NAT Gateways. NAT Gateways must be created in a public subnet and require an Elastic IP address.
Route Table
Controls traffic flow in your VPC. Instances in private subnets need a route to the NAT Gateway (0.0.0.0/0 -> nat-gateway-id) for outbound internet access.