4 ms·
The NAT tax is real. We got to tens of thousands of registered users of our app with the $30/month NAT gateway being like 90% of our AWS bill. And it didn't eve
by bilalq 3y ago
The NAT tax is real. We got to tens of thousands of registered users of our app with the $30/month NAT gateway being like 90% of our AWS bill. And it didn't even serve customer facing traffic! At the time, it's only use was for a serverless Aurora DB used by background jobs.
It only gets more expensive when you actually serve large amounts of traffic, need multi-AZ setups, and run multiple AWS accounts for different envs for beta/prod and each engineer's sandbox account. The worst part of cloud billing is how each base cost has several dimensions of multipliers.
- candiodari 3y agoYou do realize this is AWS policy, right? I mean you cannot run away from AWS costs ... on AWS. They are targeting dollar amounts of profits for themselves, not charging cost+20% for service X. They will find some other way to charge you the yet more than you're saving here, because MBA culture. And AWS is like 10x more expensive than dedicated hosting, minimum. Not 10%, 1000%. To the point that for the price of I mean if cost matters to you you need to move out of the cloud. Plenty of Kubernetes hosting these days, and very easy to set it up yourself.
- fulafel 3y agoThis. You then work to dig deeper into the vendor lock-in, to move your apps to use apparently cheaper AWS-only services, and if you're wily (or oblivious) you can report this as cost savings.
- deleted 3y ago[deleted]
- paulddraper 3y agoI don't pay the NAT tax. I just use public IP addresses. It's fine, it works. Worked for EC2-Classic, works today.
- ipython 3y agoYou now get charged for ipv4 addresses as well. Less than nat, yes, but now ipv4 addresses are no longer free either.
- paulddraper 3y agoSo upgrade to IPv6.
- dilyevsky 3y agoand if you want to connect to anything ipv4-only like, say GitHub, then what?
- chaz6 3y agoUse a nat64 gateway (a list is at https://nat64.xyz https://nat64.xyz).
- thelastparadise 3y agoJust bolting on thing after thing to make it sort of work, maybe, sometimes. I'll be sticking with ipv4.
- paulddraper 3y agoIPv6 NAT is "bolting on thing after thing" but IPv4 NAT is good architecture :P
- dilyevsky 3y agoYou do realize you also need dns64 for this to work right? So in fact your proposed architecture is strictly worse
- 3y ago
- outworlder 3y agoI don't know about your specific network architecture but, if you need to access AWS services from inside your VPC, make sure to configure a VPC endpoint for the services where it is available(RDS is one of them). Far too many people forget about that and send their AWS traffic through their NAT GWs.
- icedchai 3y agoKeep in mind for low traffic sites, it may be cheaper to use NAT, if you already need it for something else. All those "VPC endpoints" can really add up. It's kind of crazy you gotta pay for the privilege of connecting to AWS from within AWS.