zxkane / snat

Purpose built Simple NAT instance on AWS.

Simple NAT

It's a CDK construct to create NAT instances on AWS.

It supports adding specific IP CIDRs to route tables of VPC, the network traffic to those IP CIDRs will be forwarded to the NAT instances.

It supports routing to below services out of box,

• Github git servers
• Google
• Cloudflare

Install

TypeScript/JavaScript:

yarn add cdk-construct-simple-nat

or

npm install cdk-construct-simple-nat

Usage

import { SimpleNAT } from 'cdk-construct-simple-nat';

new SimpleNAT(this, 'SimpleNAT', {
  vpc,
  natSubnetsSelection: {
    subnetType: SubnetType.PUBLIC,
    onePerAz: true,
  },
})
.withGithubRoute();

See the complete example and API doc.

FAQ

What's the difference between EC2 NAT instances and NAT instances created by this construct

There are below differences,

• EC2 NAT instance will route all Internet traffic to itself by default
• NAT instance uses depracated Amazon Linux AMI, this construct always uses latest Amazon Linux 2 AMI
• NAT instances created by this construct can work with NAT gateways together, you can have multiple NAT instances in one VPC
• This construct can help when only routing specific traffic(for example, github/gist) to NAT instances which acts as transit proxy

What's the difference between CDK built-in NAT instances and NAT instances created by this construct

• CDK built-in NAT instances has to be created with VPC stack, this construct can add NAT instances to any existing VPC
• You can use this construct multiple NAT instances for different purposes
• This construct allows you customize the instances how to route the traffic

The deployment fails due to the routes in route table exceeds the limit

The default routes in route table is 50, the deployment will fail if adding routes more than the limit of your account. You can increase the limit up to 1000 routes per route table via service quota.

How to exclude IPv6 CIDR with built-in github/google/cloudflare routes

You can exclude IPv6 CIDR like below,

new SimpleNAT(this, 'SimpleNAT', {
  vpc,
})
.withCloudflareRoute({
  excludeIPv6: true,
});

snat's Issues

Add `machineImage` prop

Thanks for the library! I was using the Terraform version, but switched my infra as code to CDK, so this has been super helpful.

Can we include an option to specify the machine image? I'd like to use ARM AMIs.

• 👋 I may be able to implement this feature request

---

This is a 🚀 Feature Request

Question Use Case: Allow List IP - Third Party Service

❓ Allow List IP - Third Party Service

Hi, I need to provide a third party a list of allowed IPs from which to filter my requests.

Therefore, my AWS lambdas need to run within those IPs in order to communicate with the third party service.

I am currently solving this problem with a VPC with a NAT Gateway with one associated EIP. (cannot associate more EIPs to the same NAT)

The problem is that as I scale, I really need multiple EIPs associated with the NAT, and then to have my Lambda function randomly assigned to one of the static IPs from the list of allowed IPs, every time they got invoked (even the same IP twice is fine, but ideally long-term I want to rotate between all IPs of the subnet).

Do you think snat could be useful for this use case? If yes, how?

Thank you very much for the work done.

Do you think snat could be useful for this use case? If yes, how?

Environment

• Version: latest
• CDK CLI Version: 2.99.0
• Node.js Version: 20
• OS: MacOS

Differences between official solution?

❓ General Issue

How is this different than? https://docs.aws.amazon.com/cdk/api/latest/docs/aws-ec2-readme.html#using-nat-instances