AWS just made a big dent in NAT gateway bills. You can now run Lambda in VPCs with IPv6 and an egress-only Internet gateway - no more always-on NAT draining your wallet.
Keep the private subnets locked down. Still get outbound Internet access. IPv6 handles the traffic, slicing out the NAT middleman.
