<p>Remember that you should be engineering to your requirements around cost, resilience and performance.</p>

<p>If your constraint is around cost, then yes, a single NAT gateway, with both subnets having routing tables that route public IP traffic to the NAT gateway is a viable approach.  If you are this cost sensitive, are you sure that AWS is the right hosting environment?</p>

<p>If your constraint is around having all traffic arrive on the internet from a single elastic IP address, then may i suggest that having two NAT gateways in different subnets in different AZ's is a better choice. You will need one elastic IP address on the active NAT gateway, with routing tables for the private subnets pointing internet traffic to the active NAT gateway.  In the event of a network failure, have a script that moves the elastic IP address to the standby NAT, and then update the route tables to send internet traffic to the second NAT, making it now the active NAT.</p>

<p>Do not fall into the false economy of thinking that you can spin up the replacement NAT at failover time, as it only takes a few seconds. When large catastrophic failures happen within AWS, the processes for the creation of new resources into the surviving AZ's become far busier than normal, and new requests seem to be queued. you would have an unpredictable RTO with this approach. A single NAT should be treated as accepting that on rare occasions, a 12 hour outage is acceptable.</p>

CC BY-SA 4.0
2020-05-28T12:23:42.283Z
2020-05-28T12:23:42.283Z
Michael Shaw
<p>This is not a good practice. <a href="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html" rel="nofollow noreferrer">AWS</a> docs explicitly mentions that </p>

<blockquote>
  <p>Each NAT gateway is created in a specific Availability Zone and
  implemented with redundancy in that zone</p>
</blockquote>

<p>That means that if all of your private subnets share traffic to a same NAT gateway, in case the AZ where the NAT is located goes down you are loosing your whole 'private environment'.</p>

CC BY-SA 4.0
2020-05-22T07:56:44.690Z
2020-05-22T07:56:44.690Z
Recoba20
<p>I have two NAT gateway attachments for two private subnets in AWS. Is it possible to have one NAT gateway attachment for two private subnets so that I can save one EIP?</p>

<amazon-web-services><aws-vpc>
One NAT attachment for two private subnets
Moses Liao GZ
# One NAT attachment for two private subnets

(Asked by: username_0 on 2020-05-22)

I have two NAT gateway attachments for two private subnets in AWS. Is it possible to have one NAT gateway attachment for two private subnets so that I can save one EIP?

**Tags:** amazon-web-services, aws-vpc


---

## 2 answers

### Answer by username_1 on 2020-05-28. Score: 4

Remember that you should be engineering to your requirements around cost, resilience and performance.

If your constraint is around cost, then yes, a single NAT gateway, with both subnets having routing tables that route public IP traffic to the NAT gateway is a viable approach. If you are this cost sensitive, are you sure that AWS is the right hosting environment?

If your constraint is around having all traffic arrive on the internet from a single elastic IP address, then may i suggest that having two NAT gateways in different subnets in different AZ's is a better choice. You will need one elastic IP address on the active NAT gateway, with routing tables for the private subnets pointing internet traffic to the active NAT gateway. In the event of a network failure, have a script that moves the elastic IP address to the standby NAT, and then update the route tables to send internet traffic to the second NAT, making it now the active NAT.

Do not fall into the false economy of thinking that you can spin up the replacement NAT at failover time, as it only takes a few seconds. When large catastrophic failures happen within AWS, the processes for the creation of new resources into the surviving AZ's become far busier than normal, and new requests seem to be queued. you would have an unpredictable RTO with this approach. A single NAT should be treated as accepting that on rare occasions, a 12 hour outage is acceptable.


---

### Answer by username_2 on 2020-05-22. Score: 2

This is not a good practice. [AWS](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html) docs explicitly mentions that

> Each NAT gateway is created in a specific Availability Zone and
> implemented with redundancy in that zone

That means that if all of your private subnets share traffic to a same NAT gateway, in case the AZ where the NAT is located goes down you are loosing your whole 'private environment'.


---

