A design places a NAT gateway in every Availability Zone. The availability requirement is that only two of the four zones need outbound internet, and the NAT data charge is the top network cost. What should change?
Select an answer to reveal the explanation.
Short Explanation
You’re paying for doors nobody uses. Since you need outbound internet from only two zones, keep a NAT gateway in each of those zones and route only their subnets to it. Giving every instance a public IPv4 address would be a broader design change, not a way to keep private egress. Right-sizing the gateways cuts needless cost.
Full Explanation
NAT gateway charges reflect both the gateways you run and the data they process, so keeping a gateway in every zone adds cost when only two zones need outbound internet. Keep a NAT gateway in each of those two zones and route only the subnets that need egress through them; keeping each zone’s routes pointed at its own gateway also avoids depending on another zone’s gateway. Adding a fifth NAT gateway in a zone with no private subnets adds cost without providing needed egress. Replacing NAT gateways with public IPv4 addresses on every instance changes the private-subnet security boundary and exposes a wider design; it is not simply a way to reduce NAT charges. Deleting all NAT gateways removes the egress path that the two required zones still need. Caveat: a private subnet whose route still points to a deleted gateway loses access for tasks such as downloading patches, so change routes only for subnets that do not need egress. As a practical check, verify that the two required zones can still reach the internet, that their subnets use their own NAT gateways, and that the NAT inventory matches those zones; the NAT bill should fall when unused gateways are removed.