👉 AWS Debug Games (Beta) - Prove your AWS expertise by solving tricky challenges.

👉 AWS Debug Games - Prove your AWS expertise.

Monitor VPC NAT gateways with CloudWatch metrics and alarms

Michael Wittig – 15 Aug 2022

Many VPC designs make use of public and private subnets. A NAT gateway is needed to communicate from a private subnet with the Internet.

Monitor VPC NAT gateways with CloudWatch metrics and alarms

A VPC NAT gateway is a finite resource that can be exhausted. That’s why you need to add monitoring to be alerted if the NAT gateway gets a bottleneck.

CloudWatch metrics

Each NAT gateway sends metrics to CloudWatch that we can monitor with CloudWatch alarms. We recommend creating alarms for the following metrics:

  • ErrorPortAllocation: The number of times the NAT gateway could not allocate a source port.
  • PacketsDropCount: The number of packets dropped by the NAT gateway.

Monitoring throughput utilization

Unfortunately, NAT gateways do not report a single metric on the throughput utilization of bandwidth and packets. The maximum bandwidth is 100 Gbit/second and 10,000,000 packets/second. Luckily, we can calculate throughput by using CloudWatch metric math.

To calculate the bandwidth utilization, we use the following metrics:

ID metric statistic period
in1 BytesInFromDestination Sum 60
in2 BytesInFromSource Sum 60
out1 BytesOutToDestination Sum 60
out2 BytesOutToSource Sum 60

And the following expressions:

ID expression comment
bandwidth (in1+in2+out1+out2)/60*8/1000/1000/1000 Bytes/min to Gbit/s
utilization bandwidth/100*100 to %; 100 Gbit/s is the hard limit

marbot’s Monitoring Setup Assistant

CloudWatch metric math sounds complicated? We have you covered! Monitor NAT gateways and receive alerts in Slack or Microsoft Teams with our ChatOps bot marbot!

PS: If marbot is not your thing, you can still find inspiration in marbot’s CloudFormation template.

Become a cloudonaut supporter

Michael Wittig

Michael Wittig ( Email Twitter LinkedIn Mastodon )

We launched the cloudonaut blog in 2015. Since then, we have published 365 articles, 68 podcast episodes, and 68 videos. It's all free and means a lot of work in our spare time. We enjoy sharing our AWS knowledge with you.

Please support us

Have you learned something new by reading, listening, or watching our content? With your help, we can spend enough time to keep publishing great content in the future. Learn more

Amount must be a multriply of 5. E.g, 5, 10, 15.

Thanks to Alan Leech, Alex DeBrie, Christopher Hipwell, Jason Yorty, Jeff Finley, jhoadley, Johannes Konings, John Culkin, Jonathan Deamer, Juraj Martinka, Ken Snyder, Markus Ellers, Oriol Rodriguez, Ross Mohan, sam onaga, Satyendra Sharma, Simon Devlin, Todd Valentine, Victor Grenu, and all anonymous supporters for your help! We also want to thank all supporters who purchased a cloudonaut t-shirt.