6 ms·
New Managed NAT Gateway for AWS
- mattbillenstein 11y agoThis seemed to be something that was missing from their VPC offering -- I'll probably use it, but you still need an instance with a public ip for administration into the other instances on the private subnets if you're not using an ipsec VPN AFAICT.
- benley 11y agoAnyone else find it somewhat baffling that it's taken until now for a NAT service to arrive on AWS? I'm happy to have it available of course, definitely not going to complain. I've just long wondered why it wasn't a thing since the early days of VPC.
- Rapzid 11y agoI find this pretty typical of AWS TBH. You could ask the similar questions about other service like: Why can I make IAM policies for EC2 that key in on tags, but not other services? Why can I filter on tag for some resources in the console but not all? Why don't ALL resources support tags?! IAM would be way less of a PITA if you could put resources into groups.. Hey, if they had tag support for all of their resources and you could restrict access to them like ec2 that would be like resource groups... Why can't I pay more to just scale ELB's up? Why don't ELB's support connection draining...(this has been addressed but was the most complained about ELB shortcoming for a long time). Etc. Etc. Etc. But hey, things are not so bad and have really improved quite a bit in all fairness.
- cheeseprocedure 11y agoI wonder the same, though the engineering under the hood is more interesting than I thought: http://perspectives.mvdirona.com/2015/12/vpc-nat-gateways-transactional-uniqueness-at-scale/ http://perspectives.mvdirona.com/2015/12/vpc-nat-gateways-tr... > The connections are managed by a fault-tolerant co-operation of devices in the VPC network fabric. Each new connection is assigned a port in a robust and transactional way, while also being replicated across an extensible set of multiple devices. In other words: the NAT gateway is internally horizontally scalable and resilient. Maybe it just wasn't a priority.
- hrez 11y agoSo it's very similar to VPC Internet Gateway, only with upcharge of $0.045/Gb on traffic.
- joesmo 11y agoYou mean AWS ignores basic infrastructure components in favor of more glamorous ones? Never! </sarcasm>
- Rapzid 11y agoAt first I was really excited. Then I realized that, of course, CloudFormation support is not ready because AWS is terrible at cross-service strategy. I opened the comments at the bottom and was pleased to see people shouting for CloudFormation support :)
- nzoschke 11y agoCloudFormation Custom Resources can help with this. You can make a Lambda Function that can call the raw API, and have a CloudFormation resource call that for create, update and delete. It's a really powerful strategy for extending what CloudFormation can do.
- Rapzid 11y agoYeah, certainly could but.. Treating AWS resources as "custom" resources to hack around their long complained about CloudFormation turnaround? Ugh.. Then I have to reason about how to extract that custom resource out and replace it with the RightWay™ once it's added, which may just not even be possible... If it came to that I would rather throw in my efforts with the Terraform community(which I want to do anyway) who have already added this functionality it seems https://github.com/hashicorp/terraform/pull/4381 https://github.com/hashicorp/terraform/pull/4381 .
- nzoschke 11y agoTerraform is an awesome user space tool. I've been using the CF custom resource to manage a ton of stuff (hundreds of clusters and thousands of apps) and it's excellent. It's amazing that the service supports custom anything, and the create, update delete pattern is perfect. Replacing a custom resource with the right resource can be challenging. My strategy is to not do it. Create all new stacks the new way and have good tools to migrate parameters and data from an old stack to a new stack.
- geoah 11y agoI'll now just wait for a terraform resource for this! :D
- zAy0LfpBZLC8mAC 11y agoIsn't that completely crazy? IPv6 has been ready for production use for ... about ten years? And yet, people still build (and ostensibly are willing to buy) products that only exist in order to work around the shortcomings of IPv4?
- jo909 11y agoOf course you are right. But if you want to build a comparable architecture with IPv6, where a private Network is fully isolated from the public Internet except for a very controlled gateway, you would still need a Firewall/Router capable of handling all the traffic. Isolated (to a certain degree), private networks will not go away with IPv6, as they are a convenient security mechanism. So the name for the box will change, but not it's fundamental duty of allowing controlled traversal over network boundaries.
- NetStrikeForce 11y agoAnd you are right, too. But isolation doesn't mean translation. It is crazy that we have to use translation to overcome problems with IP space scarcity, but I guess we all got used already.
- themartorana 11y agoI don't know. I LIKE NAT. It's easy for me to reason about, easy to read and understand. I know it has a litany of shortcomings, and I'm not in a huge corporate network, but I'm going to miss it when it's gone.
- EvanAnderson 11y agoYou would like stateful packet filtering w/o NAT even more, I suspect. You've probably never gotten a chance to work in an environment where that's possible. It's nice to have one layer of complexity (NAT) removed from the equation and to work with only packet filters. (It's nice not to have to worry about split-horizon DNS, for example.)
- Pirate-of-SV 11y agoWould be nice with a low end alternative as well. At the moment I'm running the NAT instance on a t2.micro at $0.013/hour (On demand). The price of this service starts at $0.045
- Illniyar 11y agoWell, they've just released t2.nano.
- ceejayoz 11y agoIf your setup can't absorb $30/month, you probably don't need isolated private subnets and highly-available NATs.
- jake_morrison 11y agoAnnoyingly expensive. I wonder if they have a goal of restricting the number of VPCs, as you basically can't run a VPC without NAT to access other AWS services like S3. But the t2.nano instances will make a DIY solution cheaper.
- hrez 11y agoWhat makes it expensive for any significant traffic is "data processing" fee. But for S3 alone you can get away without NAT by using VPC endpoint.