How are AWS Internet Gateways physically implemented, and can different VPCs use different egress paths?
01:18 26 Sep 2026

I’m trying to understand the lower-level data path for outbound traffic from EC2, specifically around VPCs, Nitro, and Internet Gateways.

Suppose I have two EC2 instances:

EC2-A
  - VPC-A
  - IGW-A

EC2-B
  - VPC-B
  - IGW-B

Assume both instances are:

  • in the same AWS Region and Availability Zone

  • the same instance type

  • similarly configured

  • sending traffic to the same public destination IP

At the logical AWS level, I understand the flow approximately as:

EC2
  ↓
ENA / Nitro
  ↓
VPC routing
  ↓
0.0.0.0/0 → Internet Gateway
  ↓
AWS network / Internet edge
  ↓
destination

What I am trying to understand is the physical/data-plane implementation underneath this abstraction.

An Internet Gateway is documented as a horizontally scaled, redundant AWS service rather than a single physical router. If VPC-A has igw-A and VPC-B has igw-B, does AWS potentially map these two logical IGWs to different internal gateway-processing resources, forwarding domains, or Internet-edge paths?

For example, could the actual paths conceptually look like:

EC2-A
  ↓
Nitro
  ↓
ToR / AWS fabric
  ↓
IGW processing/path X
  ↓
AWS edge X
  ↓
destination

while another VPC uses:

EC2-B
  ↓
Nitro
  ↓
ToR / AWS fabric
  ↓
IGW processing/path Y
  ↓
AWS edge Y
  ↓
destination

even when the instances are in the same AZ and everything else is configured similarly?

I am especially interested in latency-sensitive workloads, where a difference of even tens of microseconds can matter.

My questions are:

  1. Does an IGW resource ID correspond in any way to a particular internal gateway-processing pool or path?

  2. Can two VPCs in the same AZ reach the same public destination through different AWS internal egress/edge paths because they use different IGWs?

  3. Is the physical/path selection based on VPC ID, ENI, flow hash/5-tuple, host placement, or some other factor?

  4. Is there any AWS-supported way to determine whether two EC2 flows are taking different internal egress paths?

  5. If I detach one IGW and attach a newly created IGW to the same VPC, is there any reason to expect the underlying physical egress path to change, or are IGW IDs purely logical abstractions over shared infrastructure?

I understand that AWS may not publicly document the exact internal implementation. I am mainly looking for any AWS documentation, re material, engineering talks, or practical observations that clarify how much of the Internet Gateway / egress path is tied to the VPC versus the underlying EC2/Nitro/physical network placement.

advice amazon-web-services amazon-ec2