Comparison
EgressvsNAT gateway
Egress
your workload calling a payment provider goes out through something with a fixed address, because the provider allow-lists it.
Traffic leaving a cluster or network for the outside world. It is the direction teams forget until two things happen: a third party requires a stable source address to allow-list, and the bill arrives with data-transfer charges on it. Controlling it also matters for security, because unrestricted egress is how a compromised workload reaches a command-and-control host or exfiltrates data.
Full entry →NAT gateway
private workloads reach the internet through a shared address, and you find the thing on your bill charging per gigabyte.
The managed component that lets instances without public addresses make outbound connections, rewriting the source address as they leave. It is a default part of nearly every private network design and one of the more common unexplained line items, because it charges for both existence and throughput. It is also a hidden capacity limit — port exhaustion under very high connection churn is a real and confusing failure.
Full entry →