{"id":57762,"date":"2026-01-13T01:36:34","date_gmt":"2026-01-13T01:36:34","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=57762"},"modified":"2026-02-21T08:45:51","modified_gmt":"2026-02-21T08:45:51","slug":"aws-architect-design-decision-matrix-nat-per-az-vs-single-nat-vs-regional-nat-for-eks-environments","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/aws-architect-design-decision-matrix-nat-per-az-vs-single-nat-vs-regional-nat-for-eks-environments\/","title":{"rendered":"AWS Architect & Design – Decision Matrix: NAT per AZ vs Single NAT vs Regional NAT for EKS Environments"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n

Final comparison table (all approaches)<\/h2>\n\n\n\n
Approach<\/th>Architecture (AZ \/ NAT)<\/th>Design<\/th>Cost profile<\/th>Parity to PROD<\/th>Terraform complexity<\/th>Risk<\/th>Best-practice fit<\/th>Pros<\/th>Cons<\/th>Typical fit (envs)<\/th><\/tr><\/thead>
A. Zonal NAT per AZ (classic HA)<\/strong><\/td>3 AZ \/ 3 NAT<\/strong> (one per AZ)<\/td>Each private subnet routes 0.0.0.0\/0<\/code> to the same-AZ<\/strong> NAT<\/td>Highest baseline<\/strong> NAT hourly; lowest cross-AZ egress cost<\/strong><\/td>Excellent<\/strong><\/td>Medium (per-AZ loops for NAT + routes)<\/td>Low<\/strong><\/td>Strong<\/strong><\/td>HA for outbound; avoids cross-AZ NAT traffic; \u201cboring\u201d operations<\/td>Pays for 3 NATs even when non-prod is quiet<\/td>PROD, UAT<\/strong>, Stage if pre-prod<\/td><\/tr>
B. Single zonal NAT shared (cost compromise)<\/strong><\/td>3 AZ \/ 1 NAT<\/strong> (in 1 AZ)<\/td>All private subnets (all AZs) route to a single<\/strong> NAT<\/td>Lower hourly<\/strong> NAT; may add cross-AZ data transfer<\/strong> for 2 AZs<\/td>Good topology parity, weaker egress parity<\/strong><\/td>Low\u2013Medium (simple NAT, but routing must be consistent)<\/td>Medium<\/strong><\/td>Compromise<\/strong><\/td>Keeps 3-AZ layout; saves NAT hourly cost<\/td>AZ containing NAT becomes egress SPOF<\/strong>; cross-AZ charges\/latency possible<\/td>Stage\/Dev<\/strong> only if outages acceptable & traffic low<\/td><\/tr>
C. Single-AZ lower envs<\/strong><\/td>1 AZ \/ 1 NAT<\/strong><\/td>Reduce VPC + cluster footprint to one AZ<\/td>Lowest overall<\/strong> (fewer subnets\/nodes\/LBs + 1 NAT)<\/td>Poor<\/strong> (no multi-AZ testing)<\/td>Low\u2013Medium (parameterized modules)<\/td>Medium\u2013High<\/strong> (late discovery of AZ issues)<\/td>OK if explicitly accepted<\/td>Cheapest + simplest; reduces many moving parts<\/td>Multi-AZ behavior not tested until UAT\/PROD<\/td>DEV<\/strong> (often), sometimes Stage (sandbox)<\/td><\/tr>
D. Regional NAT Gateway (newer, simplified HA)<\/strong><\/td>3 AZ \/ \u201c1 NAT object\u201d<\/strong> (regional mode auto-expands across AZs)<\/td>Set NAT availability to regional<\/strong>; AWS manages multi-AZ expansion\/contraction<\/td>Can approach per-AZ cost<\/strong> depending on AZ expansion; simpler ops<\/td>Excellent<\/strong><\/td>Low (fewer NAT resources\/route concerns)<\/td>Low\u2013Medium (newer feature adoption)<\/td>Strong<\/strong> (modern best practice option)<\/td>\u201cHA by default\u201d + simpler architecture; reduces need to manage per-AZ NAT placement<\/td>Newer operational patterns; Terraform changes (auto\u2194manual) can recreate<\/td>PROD\/UAT\/Stage<\/strong>, possibly Dev if you keep 3 AZ<\/td><\/tr>
E. NAT Instance (DIY)<\/strong><\/td>1\u20133 AZ \/ EC2-based NAT<\/td>Replace NAT GW with EC2 NAT instances + routes<\/td>Lowest if tiny<\/strong>, but adds ops overhead<\/td>Depends<\/td>High (patching\/scaling\/HA)<\/td>Medium\u2013High<\/td>Not preferred for platform teams<\/td>Cheap for DEV; can stop when unused<\/td>You own uptime, scaling, patching, throughput limits<\/td>DEV only (if extreme cost pressure)<\/td><\/tr>
Add-on: VPC Endpoints (EKS cost lever)<\/strong><\/td>Works with any of the above<\/td>Use S3 gateway endpoint + interface endpoints (ECR, CloudWatch Logs, STS\/KMS\/SSM, etc.)<\/td>Often reduces NAT $\/GB<\/strong> materially<\/td>Improves consistency & reliability<\/td>Medium (endpoint set + SG\/policies)<\/td>Low<\/td>Strong<\/strong><\/td>Reduces NAT traffic, improves security (no internet path)<\/td>Endpoint hourly costs exist; needs policy\/governance<\/td>All envs<\/strong> (especially PROD\/UAT)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Source-backed notes (why these rows look like they do)<\/h3>\n\n\n\n