As a best practice, AWS customers should deploy resources that don’t require direct internet access, such as EC2 instances, databases, queues, caching, or other infrastructure, into a VPC private subnet. Those workloads can take advantage of VPC endpoints to call AWS services privately without having to traverse the public internet. Some workloads require occasional updates from external sources. You can use a NAT gateway so that instances in a private subnet can connect to services outside your VPC but external services cannot initiate a connection with those instances. Since these updates often occur during a scheduled maintenance window, NAT Gateways aren't necessarily required to be in place all the time and can be created and deleted only when needed via a just-in-time (JIT) networking workflow.

This project contains source code and supporting files for a serverless application that allocates an Elastic IP address, creates a NAT Gateway, and adds a route to the NAT Gateway in a VPC route table. The application also deletes the NAT Gateway and releases the Elastic IP address.