CreateNatGateway - Amazon Elastic Compute Cloud
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China.


Creates a NAT gateway in the specified subnet. This action creates a network interface in the specified subnet with a private IP address from the IP address range of the subnet. You can create either a public NAT gateway or a private NAT gateway.

With a public NAT gateway, internet-bound traffic from a private subnet can be routed to the NAT gateway, so that instances in a private subnet can connect to the internet.

With a private NAT gateway, private communication is routed across VPCs and on-premises networks through a transit gateway or virtual private gateway. Common use cases include running large workloads behind a small pool of allowlisted IPv4 addresses, preserving private IPv4 addresses, and communicating between overlapping networks.

For more information, see NAT gateways in the Amazon Virtual Private Cloud User Guide.

Request Parameters

The following parameters are for this specific action. For more information about required and optional parameters that are common to all actions, see Common Query Parameters.


[Public NAT gateways only] The allocation ID of an Elastic IP address to associate with the NAT gateway. You cannot specify an Elastic IP address with a private NAT gateway. If the Elastic IP address is associated with another resource, you must first disassociate it.

Type: String

Required: No


Unique, case-sensitive identifier that you provide to ensure the idempotency of the request. For more information, see How to ensure idempotency.

Constraint: Maximum 64 ASCII characters.

Type: String

Required: No


Indicates whether the NAT gateway supports public or private connectivity. The default is public connectivity.

Type: String

Valid Values: private | public

Required: No


Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.

Type: Boolean

Required: No


The subnet in which to create the NAT gateway.

Type: String

Required: Yes


The tags to assign to the NAT gateway.

Type: Array of TagSpecification objects

Required: No

Response Elements

The following elements are returned by the service.


Unique, case-sensitive identifier to ensure the idempotency of the request. Only returned if a client token was provided in the request.

Type: String


Information about the NAT gateway.

Type: NatGateway object


The ID of the request.

Type: String


For information about the errors that are common to all actions, see Common client error codes.


Example 1

This example creates a public NAT gateway in the specified subnet and associates the Elastic IP address with the specified allocation ID to the NAT gateway.

Sample Request &SubnetId=subnet-1234567890abcdef0 &AllocationId=eipalloc-0abcdef1234567890 &AUTHPARAMS

Sample Response

<CreateNatGatewayResponse xmlns=""> <requestId>1b74dc5c-bcda-403f-867d-example</requestId> <natGateway> <subnetId>subnet-1234567890abcdef0</subnetId> <natGatewayAddressSet> <item> <allocationId>eipalloc-0abcdef1234567890</allocationId> <networkInterfaceId>eni-0123abc456def7890</networkInterfaceId> <privateIp></privateIp> <publicIp></publicIp> </item> </natGatewayAddressSet> <createTime>2019-11-25T14:00:55.416Z</createTime> <vpcId>vpc-0598c7d356eba48d7</vpcId> <natGatewayId>nat-04e77a5e9c34432f9</natGatewayId> <connectivityType>public</connectivityType> <state>pending</state> </natGateway> </CreateNatGatewayResponse>

Example 2

This example creates a private NAT gateway in the specified subnet.

Sample Request &SubnetId=subnet-1234567890abcdef0 &ConnectivityType=private &AUTHPARAMS

Sample Response

<CreateNatGatewayResponse xmlns=""> <requestId>1b74dc5c-bcda-403f-867d-example</requestId> <natGateway> <subnetId>subnet-1234567890abcdef0</subnetId> <natGatewayAddressSet> <item> <networkInterfaceId>eni-1a2b3c4d5e6f78901</networkInterfaceId> <privateIp></privateIp> </item> </natGatewayAddressSet> <createTime>2021-06-05T14:00:55.416Z</createTime> <vpcId>vpc-0598c7d356eba48d7</vpcId> <natGatewayId>nat-04e77a5e9c34432f9</natGatewayId> <connectivityType>private</connectivityType> <state>pending</state> </natGateway> </CreateNatGatewayResponse>

See Also

For more information about using this API in one of the language-specific Amazon SDKs, see the following: