NAT Gateway across clouds
Managed egress for private subnets - NAT Gateway on AWS and OCI, Azure NAT Gateway, Cloud NAT - with the routes written and the address stable.
10 verified modules, 2 of them live-tested apply→verify→destroy; the rest are static-validated, live-test pending.
Compare by provider
| Provider | Module | Verification |
|---|---|---|
| Alibaba Cloud | An Enhanced NAT Gateway for an Existing VPC with Its EIP and SNAT Entries | static-validated |
| AWS | NAT Gateways for an Existing VPC, One per Zone, with the Private Routes Written | ✓ live-tested |
| Azure | Egress with Enough SNAT Ports to Survive the Afternoon | static-validated |
| Google Cloud | Cloud NAT Gateway | ✓ live-tested |
| Huawei Cloud | A Public NAT Gateway for an Existing VPC with Its EIP and SNAT Rules | static-validated |
| IBM Cloud | VPC Public Gateways per Zone with the Subnets Attached | static-validated |
| Oracle Cloud | A NAT Gateway for an Existing VCN with Its Route Table and a Reserved Address | static-validated |
| Scaleway | A Public Gateway on a Reserved Address with Masquerade, Bastion and SMTP Off | static-validated |
| Tencent Cloud | A NAT Gateway for an Existing VPC with Its EIP and the Route Entries Written | static-validated |
| UpCloud | An UpCloud Gateway with NAT, Attached to the Router of the Networks It Serves | static-validated |
How to choose
Decide zonal or regional first: AWS and Azure place a gateway in a zone, and a private subnet in another zone pays cross-zone charges to reach it, while Cloud NAT is regional and the OCI gateway serves the whole VCN. Then compare what the address is (reserved or ephemeral), how many ports a source gets before connections are refused, and what the hourly charge is when nothing moves.
When not to use
A NAT gateway is egress only, and it is where the cloud bill hides: per-gigabyte charges on every byte that leaves, including traffic bound for services in the same cloud, which a private endpoint would have carried for less.