S4 NAT - Cost-Optimized NAT for Amazon VPC

S4 NAT gives the private subnets in your Amazon VPC cost-optimized internet egress, built on a standard EC2 instance. It performs source NAT (MASQUERADE) for your private subnets so they can reach the internet, and you pay only a flat hourly software fee plus the price of the instance you choose - there is no per-GB data-processing charge, so the cost is predictable and decoupled from egress volume. Bandwidth scales with the instance type you select.

High availability is built in. Deploy the active/standby CloudFormation template and the standby continuously heartbeats the active; on failure it rewrites the private route table(s) to its own ENI via ec2:ReplaceRoute, typically completing route failover in well under ten seconds (validated over 170+ consecutive failover drills across releases, in the v1.1 round 74/74 route flips under 11 seconds including test-harness dispatch latency). Optionally, enable the stable-egress mode (StableEgressIp) and a shared Elastic IP rides the route owner, keeping the egress public IP your downstream allowlists constant across failover - typically stabilizing in under ten seconds, with an availability-first design that briefly falls back to the instance's own Elastic IP rather than dropping traffic if the IP move lags (validated with client-side egress sampling: longest observed non-shared window 2 seconds, zero black-holes). New connections succeed immediately. Note this is fast failover, not hitless: in-flight (established) connections are reset and clients reconnect, which is acceptable for the short-lived, auto-retrying connections that dominate NAT egress.

Beyond cost and HA, S4 NAT includes NAT64 (RFC 6146, via an integrated translator) so IPv6-only subnets can reach the IPv4 internet, and an optional XDP/eBPF fast path (shipped on the AMI, enabled with one config line) that offloads established-flow forwarding below the kernel networking stack - measured at roughly 2x the packets-per-second per CPU core of the standard kernel path on network-optimized instances, with automatic interface tuning for native attach. The kernel nftables path remains the default, fully supported data plane. The control-plane daemon is a single static binary with a least-privilege IAM role. There is no lock-in - it is a normal Amazon Linux 2023 AMI you run in your own VPC. Billed per instance per hour through your AWS bill.