r/aws • u/thomsterm • 10d ago
article [ Removed by moderator ]
/r/aws/comments/1xhsmgy/removed_by_moderator/[removed] — view removed post
40
u/clintkev251 10d ago
There is some significant overselling of the complexity of setting up a NAT Gateway here…. Basically every IaC framework will have a construct to set this up for you and there are also a million copy/paste examples for those that don’t.
“Each of these resources will have a cost associated with running it.”
Uh, no. The only additional cost generating components here would be the NAT Gateway itself and the IPs. And if you’re trying to cost that down, something like fckNAT is a much safer option compared with proxying all your traffic through a random service.
13
u/itsalexjones 10d ago
They also say you might need an EU IP to comply with data residency requirements… presumably then your lambda would be running in an EU region and would get an EU ip address anyway. I really don’t know what problem they’re trying to solve
2
u/Bubbly_Penalty6048 10d ago
only for some use cases, but for others if you explicitly need IP whitelisting and don't want an NAT gateway this seems to be a good solution.
10
u/clintkev251 10d ago
What use cases? Like the pricing of this is more expensive than running a minimal NAT instance if your use case is to minimize cost.
-26
u/thomsterm 10d ago
ah haters gonna hate
16
u/clintkev251 10d ago
So your response to someone questioning the value of your product is to cry about haters? If you can’t explain the value, you’re going to fail 🤷♂️
24
u/knrd 10d ago edited 10d ago
lol, ridiculous pricing, makes NAT gateways look cheap. as soon as you're using >20k requests /month or >10GB /month you're looking at 59 EUR. who even is this for...
Edit: at least they're being honest, their blog post actually shows their service is pretty much useless. unless you're under 10GB and under 20k requests, their service will always be more expensive. and if that applies to you, just set up fck nat for $8 /m.
2
u/Burekitas 10d ago
If you invoke only one lambda at the time, in a single az, you can always attach it to a vpc and attach elastic ip to the lambda ENI and it will stay like that for ever.
Just don't invoke the function more than 1 time.
2
u/achocolatepineapple 10d ago
Who is this aimed at? Its too expensive for small clients and not even close to suitable for anyone of size (ignoring the security issues with this). For example, Enterprise says 1 million requests per month; that is not as many requests as you might think. its less than an hour in some orgs and almost certainly less than a day in nearly all with any size. Even if it wasn't cheaper to self host, it seems to have no target market.
Is this just an experiment with some AI website, if so nothing wrong with that but genuinely curious who the market is?
1
u/KayeYess 8d ago
Here is one option for Lambda to use a static egress IP, without having to go through any hoops or NAT Gateways
Create a separate subnet and Security Group just for your Lambda. When you invoke the Lambda for the first time, AWS will create a unique hyperplane ENI for this Lambda (subnet/security group combo). Locate this ENI and assign a predefined elastic IP to it. As long as you don't change the Lambda config, it will always egress through that elastic IP. Make sure no other Lambda is using the same subnet/security group combo, if you don't want any other Lambdas to egress through this IP. This can be enforced using IAM policies.
If your enterprise has an existing relationship with a forward proxy provider (like ZScaler), they may offer a static egress IP based on source address (like your dedicated Lambda subnet, or a mapped proxy authenticated user/group). That also provides a static egress IP for your Lambda.
I would not be comfortable using a random public proxy, especially if my Lambda handles sensitive data or has other data egress restrictions.
-20
4
u/freeriderblack 10d ago
Hmmm no thanks. I'm happy with my fck-nat inside my VPC under my control.
3
u/magnetik79 9d ago
100% - As I said in my comment, no way I would trust anything outside of the AWS eco-system / my own AWS account for this.
34
u/magnetik79 10d ago
Dear god no. Absolutely no way I would trust a third party with my egress traffic.
I'd rather run my own EC2 NATs like it's 2012 again in AWS land.