Amazon VPC: ami-vpc-nat: throughput of micro instance

Question

I am manually setting up an Amazon VPC network, and have a need to create a NAT instance. Amazon has VPC specialized AMIs that come in various scales. Due to budget considerations, I am ambling towards using a micro instance of ami-vpc-nat.

I am concerned that with only 613mb, a micro instance may struggle when as more instances are put behind the NAT instance. Please, can anyone who has deployed this microinstance ami-vpc-nat (especially in production) share their thoughts on its performance and throughput.

Answer 1

I'm responsible for a VPC estate, with long experience of using various instance types and a good understanding of their characteristics. These characteristics can easily be tested and profiled by anyone and relied-upon as (generally) constant with the exception of the t1.micro type.

The t1.micro instance-type is highly variable in both CPU and network performance, since it is essentially using aggregate 'spare' capacity on the host on which it is running (which of course will be running a variety of other instances and instance-types also). It is also subject to aggressive demand throttling on CPU and network usage - there is a distinctive profile in force which limits extended high-load usage, and which then adaptively returns capacity to the instance after such a high-load threshold has been reached and capped.

When configuring my VPC estate, I initially downgraded the NAT instance from m1.small to t1.micro, reasoning that a simple network gateway appliance was unlikely to demand the capacity of the m1.small type, and since it was always-on then I should pay the lowest price possible. However, observation (and later confirmation by an Amazon engineer) showed that as the estate grew and NAT load went up, the t1.micro throttle profile presented a definite and measurable bottleneck. Switching back to m1.small, with its' pre-allocated and constant network bandwidth, eliminated that bottleneck.

In short, your NAT instance will choke your VPC estate internet access if it is a t1.micro - traffic into and out of the VPC (other than over a VPN) will quickly trigger the bandwidth throttle as soon as throughput rises for longer than the duration limit, and will stay throttled until demand drops (after which the throttle will adaptively release). Your network throughput through the NAT will be choppy and sluggish in all but minimum load scenarios.

Answer 2

Network and CPU performance are also defined by instance type, and final performance is subject to many factors, so you would need to test and measure in your context to be sure.

That being said, i just ran iperf on my untuned, out-of-the-box m1.micro and got around 80 Mbits/sec. But that's just me...

Answer 3

The new generation t2 instances are more powerful and more cost-efficient than t1s. Using t2.micro, backed by SSD as Root device, is preferred over t1 in terms of spinning up NAT instances. Then use a pair of Auto scaling groups in a min of 2 AZs to build a HA, self-healing NATs. Ensure use HVM-based (Virtualization Type) AMIs for t2 to support them.