A greenfield VPC design places many private subnets across AZs, eac…

Question

A greenfield VPC design places many private subnets across AZs, each expected to reach AWS APIs and limited internet destinations. NAT Gateway spend projections are high. What networking cost control should architects prioritize?

Accepted Answer

Prefer VPC endpoints for AWS service traffic and thoughtfully consolidate NAT Gateway placement rather than deploying unnecessary NAT Gateways in every subnet path by default. — Every NAT Gateway is a meter running in the basement—use endpoints for AWS APIs and don’t plant a NAT in every empty closet. Cutting all egress or bouncing APIs through on-prem over the public net isn’t clever thrift.

Answer

Deploy a NAT Gateway in every private subnet including empty lab subnets with no egress requirement.

Answer

Disable all private subnet egress permanently so patching and telemetry can never leave the subnet.

Answer

Hairpin all AWS API calls from private subnets through an on-premises proxy over the public internet only.

A greenfield VPC design places many private subnets across AZs, each expected to reach AWS APIs and limited internet destinations. NAT Gateway spend projections are high. What networking cost control should architects prioritize?

Short Explanation

Full Explanation