Creating a NAT gateway
Unless required, your instances should not be publicly exposed to the Internet. When your instances are on the Internet, you have to assume they will be attacked at some stage.
This means most of your workloads should run on instances in private subnets. Private subnets are those that are not connected directly to the Internet.
In order to give your private instances access to the Internet, you use network address translation (NAT). A NAT gateway allows your instances to initiate a connection to the Internet, without allowing connections from the Internet.
Getting ready
For this recipe, you must have the following existing resources:
- A VPC with an Internet gateway (IGW)
- A public subnet
- A private subnet route table
You will need the IDs for the public subnet and private subnet route table. Both of these resources should be in the same AZ.
How to do it...
- Start with the usual CloudFormation template version and description:
AWSTemplateFormatVersion: "2010-09-09" Description...
