Private instances in a factory VPC suddenly cannot reach the internet to pull patches. The private subnet's default route now shows a blackhole status because the NAT gateway was deleted during a cleanup. What restores egress?
Select an answer to reveal the explanation.
Short Explanation
You restore egress by creating a new NAT gateway with an Elastic IP in a public subnet and pointing the private default route at it. A deleted NAT gateway cannot be repaired, so the route stays a blackhole until you change its target. Public addresses on instances, or re-saving the same route, do not bring the path back.
Full Explanation
A public NAT gateway sits in a public subnet and uses an Elastic IP as its public address. Deleting the gateway disassociates the address, and the private subnet's default route turns to blackhole because its target no longer exists. A deleted gateway cannot be restored, so you create a new NAT gateway in a public subnet with an Elastic IP (the address must be in the same network border group as the Availability Zone) and update the default route of the private subnet to target it. Giving each private instance a public IPv4 address does not help because the subnet still has no route to an internet gateway, and it changes the security design. Re-saving the same route keeps pointing at the deleted gateway and stays a blackhole. Opening inbound port 443 does not create outbound patch traffic. Caveat: the NAT gateway must be in a subnet whose route table sends 0.0.0.0/0 to an internet gateway, or the new gateway will have no path out. Operational check: confirm the new NAT gateway is Available with an Elastic IP, the route shows active, and a private instance completes an outbound connection.