A dev environment's private subnets need occasional outbound internet (package updates — a few GB/month). Production needs managed HA. Most cost-effective approach for dev?
A.NAT gateway in each AZ, same as production
Right for prod; wasteful for low-traffic dev — hourly charges dominate.
B.A NAT instance (or moving updates to a scheduled public-subnet task)
Correct — cheap instance or public-subnet scheduling matches sporadic usage.
C.VPC endpoints for all outbound traffic
Interface endpoints only reach AWS services — not the public internet for package repos.
D.Transit Gateway for internet egress
TGW adds cost and doesn't provide internet egress itself.
Why this answer
NAT gateways bill hourly + per-GB (~$32+/mo each per AZ) — overkill for sporadic dev traffic. A small NAT instance or running update jobs in a public subnet costs a fraction. Keep managed NAT gateways for production where HA matters.
Correct answer: B · Last reviewed 2026-11-01
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Cost-Optimized Databases & Networking practice session.
Practice Cost-Optimized Databases & Networking