IPv6-first EKS on AWS in 2026: what still forces NAT back in

Since February 2024 AWS bills $0.005 per hour for every public IPv4 address, pushing a conventional three-AZ EKS setup to roughly $143 a month in NAT gateways, elastic IPs, and ALB addresses alone. That charge made IPv6-first architectures financially compelling for the first time. The team behind the isp6 platform ran an IPv6-first EKS deployment in production, using BYOIPv6 /56 allocations from their own RIPE space, an egress-only internet gateway as the default outbound path, and a single NAT gateway kept only as a fallback for legacy IPv4 dependencies.

The field report is mostly encouraging but not clean. EKS can never be truly IPv6-only: nodes stay dual-stack, and the VPC CNI silently SNATs pod traffic bound for IPv4-only destinations. RDS still requires IPv4 everywhere; public dual-stack access only shipped in October 2025, and IPv6 support for RDS's own service-API VPC endpoints landed as recently as January 2026. ECR gained dual-stack and PrivateLink support between April and November 2025, but its default hostnames still resolve to IPv4 unless you opt in. AWS SDKs default to IPv4-only endpoint hostnames too, so unopted-in API calls from an "IPv6" workload are actually IPv4. CloudFront added IPv6 origin support in September 2025, explicitly excluding S3 and VPC origins. And a long tail of external services — Stripe, GitHub, SMS and identity vendors among them — still lack AAAA records, which is precisely why that one NAT gateway survives.

The takeaway for engineers: your IPv6 posture is only as good as your weakest dependency. When everything genuinely speaks IPv6, per-environment costs drop to $0–11 a month; a single IPv4-only dependency is enough to bring back a NAT gateway and its recurring $36.50-plus monthly bill.