AWS autoscaled environment preset outbound IP

Question

We are implementing a solution that uses AWS ELB with auto-scaling.

The issue we are having is that sometimes 3rd parties that we integrate with, for example, payment gateways, require to "whitelist" our IPs. This is difficult to achieve with our setup since the IP of an auto-scaled instance is unpredictable.

I would like to refrain from using something like a separate "NAT instance", which in my mind would take all of the beauty and redundancy of our environment and create a single point of failure.

What is the best practice in this situation? Is there any suggested solution which allows for scalability and inherent reliability of EC2 and the associated services, but still ties all outbound connections to a limited set of IP addresses?

Answer 1

If this is for strictly outgoing connections to your partner's network, then a NAT Gateway is your only chance in getting one IP for all outbound connections from an Auto Scaling Group. You will need a NAT and assign an ElasticIP to it that your partner can whitelist.

If you want to avoid single points of failure, go with a managed NAT Gateway as that is much more fault tolerant than one running on EC2. You can set up two managed NAT Gateways in two different availability zones if your current infrastructure set up like that. It will cost some money as managed NAT isn't too cheap but that's your best bet IMO.