AWS Spot NAT Instance

My work often involves restricted private networks often found in large enterprises. I run a personal similarly provisioned AWS VPC for experiments. This comes with the challenge of providing internet egress for RFC1918 private subnet instances.

AWS provides several solutions for internet egress. After spending some time considering these, I settled on NAT instance running on Spot. The primary driver of this solution is cost.


Risk ETTD ETTR EETF Impact Notes
Spot Restart 5m 5m 30 days 100% Every month**
EC2 Fails 5m 5m 90 days 100% Every three months*
AZ Fails 5m 2h 180 days 100% Every six months*
Region Fails 5m 4h 730 days 100% Every two years*

Looking specifically at Spot Restart:

43,200 = 60 min * 24 hours * 30 days (valid minutes)
10     = 5 ettr + 5 ettd             (bad minutes)
99.98% = (valid - bad) / valid * 100 (fraction of good minutes)

That’s nearly four nines of reliability with the introduction of Spot. I’ve also used a generous minimum ETTD & ETTR despite the autoscale group generally recovering within two minutes.

* 90% SLA the SLO appears to be much higher.

** Based on uptime.

April 2, 2020 at 8:36:05 PM UTC+11 (1919 hours)


The following costs are an estimate:

solution network cost/GB cost/hour cost/month
NAT Gateway 5-45 Gbps 0.059 0.059 42.48
NAT Instance 0-5 Gbps 0-0.114 0.0059 4.25
NAT Instance (spot) 0-5 Gbps 0-0.114 0.0018 1.30

Spot market costs are variable but current data suggests:

t3a.nano (1) … total 69% savings


The performance test can be reproduced with the following command:

yum install python python-pip -y \
 && pip install --upgrade pip \
 && pip install speedtest-cli \
 && speedtest-cli

The t3.nano instances provide several Gbps up and down.

Download: 3283.42 Mbit/s Upload: 2274.26 Mbit/s


This solution has proven acceptable for small egress bandwidth requirements in the range of 1-5 Gbps. The Github project can be found here.