I've configured at least 3 VPCs in the last decade which were exactly that. Literally one instance with VPC service endpoints deployed and an egress NAT gatewa

I've configured at least 3 VPCs in the last decade which were exactly that. Literally one instance with VPC service endpoints deployed and an egress NAT gateway. Surprisingly common when you have a random shitbox which sucks data up from somewhere and doesn't fit within the constraints of a Lambda or something. They mostly exist to tick the compliance and architectural documents which are all under AWS "best practices". Note that I do not consider AWS "best practices" to be best practices necessarily. In fact a lot of time they are completely over-engineered against hypothetical scenarios which if they did happen, fixing some EC2 integration shitbox would not even remotely be the first problem you had to worry about. But someone demands it and someone pays for it and Bezos ain't complaining so meh!