Routing & internet access
NAT gateway (zonal and regional) vs Azure NAT Gateway
AWS NAT gateway maps to Azure NAT Gateway.
Both give private subnets outbound-only internet access from static public IPs.
Side-by-side comparison
| Aspect | Amazon Web Services | Microsoft Azure |
|---|---|---|
| Service | NAT gateway (zonal and regional) | Azure NAT Gateway |
| Lifecycle | Generally available | Generally available |
| What it is | Managed NAT that lets private subnets reach the internet or other networks. Zonal NAT gateways live in one AZ; regional NAT gateways expand across AZs automatically. | Managed outbound-only NAT for subnets, using up to 16 static public IPv4 addresses (and, on the zone-redundant StandardV2 SKU, up to 16 IPv6 addresses), with no unsolicited inbound connections. |
| Pricing model | Per NAT gateway-hour plus per GB processed. | Per NAT gateway-hour plus per GB processed, plus the public IPs. |
| Docs | NAT gateway (zonal and regional) docs | Azure NAT Gateway docs |
| Pricing page | NAT gateway (zonal and regional) pricing | Azure NAT Gateway pricing |
| Exams | SAA-C03 ANS-C01 Retiring SOA-C03 | AZ-104 AZ-700 |
Key differences
- Zones. A standard (zonal) AWS NAT gateway lives in one AZ, so you deploy one per AZ. Regional NAT gateways now expand across AZs automatically. Azure NAT Gateway Standard is zonal, and StandardV2 is zone-redundant.
- IPs. Azure NAT Gateway can use up to 16 public IPs (or prefixes) for more SNAT ports. Microsoft's comparison notes that AWS NAT gateways have a single public IP by default, but check current AWS limits for secondary addresses.
- Private NAT. AWS NAT gateways also support private NAT (to other networks without a public IP). Azure NAT Gateway is for internet egress only.
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- Per NAT gateway-hour plus per GB processed. NAT gateway (zonal and regional) pricing →
- Azure
- Per NAT gateway-hour plus per GB processed, plus the public IPs. Azure NAT Gateway pricing →
Certification exam mapping
| Exam | Provider | Level | Status |
|---|---|---|---|
| AWS Certified Solutions Architect – Associate SAA-C03 | AWS | Associate | current Italian version retires after Dec 31, 2026. |
| AWS Certified Advanced Networking – Specialty ANS-C01 | AWS | Specialty | retiring The exam is being retired. The last day to take it is Dec 31, 2026. Existing certifications stay active for their three-year period. |
| AWS Certified CloudOps Engineer – Associate SOA-C03 | AWS | Associate | current Replaces AWS Certified SysOps Administrator – Associate (SOA-C02), whose last exam day was Sep 29, 2025. Simplified Chinese and Korean versions retire after Nov 19, 2026. |
| Microsoft Certified – Azure Administrator Associate AZ-104 | Azure | Associate | current |
| Microsoft Certified – Azure Network Engineer Associate AZ-700 | Azure | Associate | current |
Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.
FAQ
What is the Azure equivalent of NAT gateway (zonal and regional)?
AWS NAT gateway maps to Azure NAT Gateway. Both give private subnets outbound-only internet access from static public IPs.
How does pricing compare between NAT gateway (zonal and regional) and Azure NAT Gateway?
AWS: Per NAT gateway-hour plus per GB processed. Azure: Per NAT gateway-hour plus per GB processed, plus the public IPs. Check the official pricing pages for current rates.
Which certification exams cover this topic?
AWS Certified Solutions Architect – Associate (SAA-C03); AWS Certified Advanced Networking – Specialty (ANS-C01) [retiring]; AWS Certified CloudOps Engineer – Associate (SOA-C03); Microsoft Certified – Azure Administrator Associate (AZ-104); Microsoft Certified – Azure Network Engineer Associate (AZ-700).