Skip to main content
Type: rvn-aws-alternat · Latest version: 0.1.2

​
Dependencies and consumers

Every dependency input can be specified manually to reference existing external infrastructure rather than a Ravion module. Set the dependency input to null and set its mapped inputs directly; see Use existing infrastructure instead of a module reference.

​
Readme

Highly available alterNAT instances that replace NAT gateway data processing charges and fail over to a NAT gateway automatically.

​
Overview

A NAT gateway charges $0.045 for every GB it processes, on top of its hourly charge. For workloads that pull images, sync artifacts, or call external APIs heavily, that per-GB charge becomes the largest networking line item. An alterNAT instance has no per-GB charge, but a single instance is a single point of failure. This module runs alterNAT, Chime’s open-source high-availability alterNAT instance design:
  • alterNAT instances in Auto Scaling groups carry your private subnets’ internet traffic
  • A connectivity tester in each availability zone checks internet access through its alterNAT instance every minute
  • Automatic failover moves the route to a NAT gateway when an alterNAT instance fails a check or terminates, so egress is never lost
  • Automatic restore moves the route back to the alterNAT instance once it is healthy again
It works with any VPC: pick a Ravion VPC network, or choose Enter values manually and enter the VPC and subnet IDs of a VPC created elsewhere. Terraform source: ravionhq/modules/networking/alternat

​
Use cases

​
When it pays off

Both sides exclude internet data transfer, which AWS bills the same either way. The fallback NAT gateway’s hourly charge (~$33/month) applies to both. Below roughly 2.5 TB a month, a NAT gateway is usually cheaper. alterNAT figures assume us-west-2 on-demand pricing: two alterNAT instances, their Elastic IPs, and the EC2 interface endpoint in two zones.

​
How alterNAT instances are placed

You list public and private subnets; the module works out the rest:
  1. It finds the route table of every private subnet (the VPC’s main route table for subnets without an explicit association).
  2. With high availability on, every availability zone that has its own private route table gets an alterNAT instance in its first public subnet, serving only that zone. Traffic never crosses zones.
  3. Private route tables shared across zones (for example a Ravion VPC network without NAT gateway high availability) are served by one alterNAT instance.
  4. With high availability off, one alterNAT instance serves every private route table.
alterNAT then owns the 0.0.0.0/0 route in those route tables. A route table that public subnets also use is rejected at plan time, since replacing its Internet Gateway route would cut the alterNAT instances off from the internet.

​
Failover

Failover keeps connectivity but not connections: established TCP connections through a failed alterNAT instance are dropped, as they are when an instance reaches its lifetime and is replaced. Clients that retry recover immediately. While failed over, traffic leaves from the NAT gateway’s public IP. Add both the alterNAT instance and NAT gateway IPs to any partner allowlist.

​
Using it with a Ravion VPC network

The VPC network manages its private route tables’ 0.0.0.0/0 route to its NAT gateway. After alterNAT takes over that route, the next VPC network deploy points it back at the NAT gateway. With Restore to alterNAT instance on (the default), alterNAT moves it back within a minute. To avoid the round trip entirely, turn off the VPC network’s NAT gateway and set Fallback NAT gateway to Create.

​
Configuration

​
Design decisions

  • Official alterNAT, pinned: The module wraps chime/alternat/aws at a pinned version rather than forking it.
  • No container image to build: The Lambda functions deploy as zip packages built from the alterNAT source; they need only boto3, which the Lambda runtime provides.
  • Graviton by default: alterNAT instances default to c7gn.medium and the Lambda functions run on arm64. The AMI architecture follows the instance type, so x86 types also work.
  • Discovery over configuration: Route tables are found from subnet associations, not from routes, so discovery is unaffected by alterNAT rewriting routes.
  • Encrypted root volumes and IMDSv2-only instance metadata.
  • Names derived from the name slug: Lambda functions, IAM roles, and Auto Scaling groups carry the slug, so several VPCs in one account can each run alterNAT.

​
Learn more

​
Inputs reference

All inputs for rvn-aws-alternat version 0.1.2. Use the name shown for each field as the input key in module config.
​
$ref:rvn-aws-network
VPC network. Ravion network to take over egress for, or Enter values manually for any other VPC.
  • Immutable after creation
Set network to null. Mapped inputs for network: set these keys alongside network, not inside it, when supplying existing infrastructure instead of a module reference.
​
section
AWS account & region.
​
string
required
AWS account.
  • Default: << ref.input.aws_account_id >>
  • Immutable after creation
​
string
required
Region.
  • Default: << ref.input.aws_region >>
  • Immutable after creation
​
string
Terraform execution environment. Override the VPC, subnet, and security group for Terraform runners. Must use the same AWS account as selected above.
  • Default: << ref.input.execution_environment_id >>
​
section
VPC.
​
string
required
VPC ID.
  • Default: <<ref.stack.output.vpc_id>>
  • Immutable after creation
​
string_array
required
Public subnet IDs. alterNAT instances run here, one in the first public subnet of each availability zone they serve.
  • Default: <<ref.stack.output.public_subnet_ids>>
​
string_array
required
Private subnet IDs. Subnets whose internet egress moves to the alterNAT instances. Their route tables are found automatically.
  • Default: <<ref.stack.output.private_subnet_ids>>

​
alterNAT instances

​
string
required
Name slug. Name prefix for all resources. Must be unique in the AWS account and region.
  • Default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
  • Immutable after creation
  • Pattern: ^[a-z0-9]([a-z0-9-]{0,26}[a-z0-9])?$ — 1-28 lowercase letters, numbers, and hyphens. Start and end with a letter or number.
​
boolean
High availability. One alterNAT instance per availability zone with its own private route table, so no traffic crosses zones. Turn off to run a single alterNAT instance for every route table.
  • Default: true
​
string
required
Instance type. Network-optimized Graviton (c7gn, c6gn) types give the most bandwidth per dollar. Instances under 32 vCPUs are capped at 5 Gbps to the internet.
  • Default: c7gn.medium
​
string_array
Elastic IP allocation IDs. One per alterNAT instance, to keep public IPs stable for partner allowlists. Leave empty to allocate new Elastic IPs.
​
number
Instance lifetime (days). Replaces each alterNAT instance on this schedule to pick up the latest AMI, dropping its open connections. 0 never replaces.
  • Default: 14
  • Min: 0
  • Max: 365

​
Failover

​
string
required
Fallback NAT gateway. Where traffic goes while an alterNAT instance is unhealthy.
  • Default: existing
  • Allowed values: existing (Use the VPC’s existing NAT gateway), create (Create a standby NAT gateway per alterNAT instance)
​
string
Fallback NAT gateway ID. Leave empty to use the VPC’s only NAT gateway, or the one in each alterNAT instance’s public subnet.
  • Shown when: {"fallback_nat_gateway_mode":"existing"}
​
keyvalue
Standby NAT gateway Elastic IP allocation IDs. Keyed by availability zone, for example us-west-2a. Leave empty to allocate new Elastic IPs.
  • Shown when: {"fallback_nat_gateway_mode":"create"}
​
boolean
Restore to alterNAT instance. Moves traffic back to an alterNAT instance as soon as it recovers, instead of when it is replaced. Requires Systems Manager access.
  • Default: true
​
string_array
Connectivity check URLs. Checked every minute from each availability zone. Traffic fails over only when all of them are unreachable.
  • Default: ["https://www.example.com","https://www.google.com"]

​
VPC endpoints

​
boolean
EC2 interface endpoint. Lets failover reach the EC2 API while internet egress is down. About $7/month per availability zone. Turn off only if the VPC already has one with private DNS.
  • Default: true
​
boolean
S3 gateway endpoint. Free. Keeps S3 traffic, including ECR image layers, off alterNAT and NAT gateways. S3 bucket policies that allowlist your alterNAT or NAT gateway IPs stop matching. Leave off if the VPC already has one.
  • Default: false
​
boolean
DynamoDB gateway endpoint. Free. Keeps DynamoDB traffic off alterNAT and NAT gateways. Leave off if the VPC already has one.
  • Default: false

​
Access

​
string_array
Allowed CIDR blocks. The VPC’s own CIDR blocks are always allowed. Add peered VPC ranges that egress through this VPC.
​
string_array
Allowed security groups. Members may route through the alterNAT instances, in addition to the VPC’s CIDR blocks.
​
boolean
Systems Manager access. Session Manager access to the alterNAT instances, with no SSH keys or open ports.
  • Default: true
​
string
SSH key pair name. Prefer Systems Manager access.

​
Instance customization

​
boolean
CloudWatch agent. Publishes per-interface network metrics. Custom metrics are billed.
  • Default: false
​
string
Custom AMI ID. Leave blank for the latest Amazon Linux 2023 minimal AMI for the instance type’s architecture.
​
text
User data before setup. Runs as root on each alterNAT instance before alterNAT configures it.
​
text
User data after setup. Runs as root on each alterNAT instance after alterNAT configures it.

​
Misc

​
keyvalue
Tags. A map of tags to assign to all resources. Default tags are Owner, ProjectGivenId, EnvironmentGivenId, ModuleGivenId, ModuleId

​
Terraform settings

​
string
OpenTofu version override. Override the environment’s default version for this module
​
string
Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
  • Immutable after creation
​
boolean
Include default plan policies. Turn off to plan with only the policies below instead of the default read-only policies. Requires at least one policy below.
  • Default: true
​
string_array
Terraform plan IAM policies. IAM managed policy ARNs for the Terraform plan runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-<AWS account number> bucket in this account.
  • Default: []
​
boolean
Include default apply policies. Turn off to apply and destroy with only the policies below instead of AdministratorAccess. Requires at least one policy below.
  • Default: true
​
string_array
Terraform apply IAM policies. IAM managed policy ARNs for the Terraform apply runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-<AWS account number> bucket in this account.
  • Default: []
​
object
Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.
  • Default: {}