Gateway Sizing
Gateway instances are sized from your actual traffic, not guesses. Before recommending a size, Outbound analyzes two weeks of CloudWatch metrics from the AWS NAT Gateway the Outbound gateway will replace.
The methodology
Section titled “The methodology”For each existing NAT Gateway, Outbound reads 14 days of CloudWatch metrics at their maximum statistic:
- Peak bytes per second — the primary sizing input.
- Peak packets per second and active connection count — collected today to refine future recommendations and to sanity-check the bandwidth-based choice.
Sizing on the 14-day peak (not the average) means the recommendation covers your busiest observed moment — nightly batch jobs, deploy storms, weekly exports — with headroom, rather than your typical Tuesday afternoon.
Instance tiers
Section titled “Instance tiers”The peak bandwidth maps to a Graviton (ARM) instance tier:
| Sustained peak bandwidth | Recommended instance |
|---|---|
| up to 32 Mbps | t4g.micro |
| up to 1.6 Gbps | c6gn.medium |
| up to 3.125 Gbps | c7gn.medium |
| up to 5 Gbps | c7gn.large |
Above 5 Gbps, Outbound doesn’t auto-recommend — we’ll size those networks with you directly.
The c6gn/c7gn families are network-optimized instances with guaranteed baseline bandwidth; t4g.micro covers the long tail of low-traffic VPCs economically. All tiers run the same gateway software.
One size per VPC
Section titled “One size per VPC”When a VPC has multiple NAT Gateways (for example, one per Availability Zone), Outbound computes the required tier for each and applies the strongest of them to all gateways in that VPC. This keeps capacity uniform, so a routing change or AZ event never lands traffic on an undersized gateway.
Resizing later
Section titled “Resizing later”Traffic grows. A resize is a standard gateway replacement: a new, larger instance is launched, routes are moved to it, and the old one is removed — and because your Elastic IP moves to the new instance, your egress IP does not change. There’s no re-onboarding, no allowlist updates, and no configuration change on your side.
What if the estimate is wrong?
Section titled “What if the estimate is wrong?”The gateway continuously reports its own host metrics (CPU, memory, network throughput), so both you and CloudPhilos can see how close a gateway runs to its capacity, and resize proactively rather than reactively. If you know a traffic change is coming — a migration, a new data pipeline — contact us at servicedesk@sue.nl and we’ll pre-size for it.