NAT Gateway Bandwidth and Throttling

Overview

Overview

NAT Gateway lets private subnet resources (EC2 instances, ECS tasks, Lambda functions) open outbound internet connections while blocking inbound ones. It has specific limits, and when they are exceeded the connectivity failures look like a general network outage.

Limits that actually bind

• Bandwidth — Up to 45 Gbps — Usually not the binding constraint
• Simultaneous connections — 55,000 per destination IP and port — Per NAT Gateway
• New connections — 900 per second to the same destination — Per NAT Gateway

> [!WARNING] Microservices making many short-lived connections to a shared database or API hit the connections-per-second limit long before bandwidth.

Metrics and what they tell you

• ErrorPortAllocation — Connection allocation failures; NAT Gateway could not accept new connections
• ActiveConnectionCount — Current active connections; trend it against the 55,000 limit
• PacketDropCount — Packets dropped; appears after connection limits are exceeded
• VPC Flow Logs on the NAT Gateway ENI, sorted by bytes — The top talkers behind high NAT cost

Route AWS traffic around NAT

Every byte to S3, DynamoDB, SQS, SNS, CloudWatch and other AWS services through NAT Gateway costs $0.045 per GB for processing, plus bandwidth charges.

• Gateway Endpoint — S3, DynamoDB — Free; traffic stays on the AWS backbone with no processing charge
• Interface Endpoint (PrivateLink) — Most other AWS services — Hourly charge, but removes NAT costs and often reduces latency

One NAT Gateway per AZ

A single NAT Gateway in a shared services VPC quickly becomes a bottleneck.

• One shared NAT Gateway — 55,000 connections — Everything loses egress
• One per AZ — 55,000 x number of NAT Gateways — Only the affected AZ

> [!TIP] Cost grows with the number of AZs, but the availability gain justifies it for production.

> [!IMPORTANT] NAT Gateway data processing is consistently the largest surprise on AWS bills.

Key concepts

ErrorPortAllocation

CloudWatch metric counting times NAT Gateway failed to allocate a connection port, indicating the 55,000 simultaneous connections or 900 new connections per second limits were exceeded.

VPC Gateway Endpoint

A free VPC endpoint for S3 and DynamoDB that routes traffic through the AWS network backbone, bypassing NAT Gateway entirely. Eliminates NAT processing costs and improves throughput for these services.

VPC Interface Endpoint (PrivateLink)

An ENI-based endpoint for most AWS services that creates a private IP address in your VPC for the service. Routes traffic over AWS network, bypassing NAT Gateway at the cost of an hourly endpoint charge.

NAT Gateway Connection Limits

55,000 simultaneous connections per destination IP/port combination and 900 new connections per second to the same destination. Exceeded limits cause ErrorPortAllocation errors and dropped connections.

NAT Gateway Data Processing Cost

$0.045 per GB of traffic processed by NAT Gateway (varies by region). Every byte from private subnets to the internet or non-endpoint AWS services incurs this charge.

When to use it

• Diagnosing private subnet resources that can no longer reach the internet or AWS services
• Explaining NAT Gateway limits and VPC endpoint cost optimization in AWS architecture interviews
• Designing private subnet networking that minimizes NAT Gateway costs and connection bottlenecks

Interview questions

• A batch job that downloads large files from S3 via ECS tasks in a private subnet is generating a $3,000 monthly NAT Gateway bill. How do you fix this?

More Troubleshooting topics

• Lambda Cold Start Latency
• Log Volume Explosion and Cost Runaway
• Memory Leak Diagnosis
• Metrics Gaps in Dashboards
• Missing Traces in Distributed Tracing
• Multi-Region High Latency
• Network Bandwidth Saturation
• OOMKilled Pod Diagnosis
• Packet Loss and Network Degradation
• Pods Stuck Pending
• PVC Mount Failures in Kubernetes
• RDS CPU at 100%