NAT Gateway
also called Network Address Translation
A managed device that lets instances in a private subnet make outbound connections without being reachable inbound.
Instances in a private subnet have no route to the internet. A NAT gateway gives them one in the outbound direction only, translating their private addresses to a shared public one — so they can fetch packages and call third-party APIs while remaining unreachable from outside.
Two things to design around. Cost: NAT is billed per hour and per gigabyte processed, and because all private egress funnels through it, a chatty workload can produce a startlingly large line item. Traffic to managed services in the same provider should usually go through a private endpoint instead, which bypasses NAT entirely.
Availability: a NAT gateway lives in one availability zone. One gateway shared across zones is both a single point of failure and a source of cross-zone data transfer charges; one per zone is the standard pattern.