Three private subnets, one in each Availability Zone, send all egress through a single zonal NAT gateway in one zone. If that zone fails, instances in the other zones lose their default route. Keeping zonal NAT gateways, what should change so a surviving zone keeps egress?
Select an answer to reveal the explanation.
Short Explanation
One ferry for three islands leaves two islands stranded when that dock closes. Your single NAT gateway lives in one Availability Zone, so a loss there black-holes the other zones. Put a NAT gateway in each zone that must survive, and keep each private route in its own zone.
Full Explanation
A NAT gateway runs in one subnet in one Availability Zone. Private route tables in the other zones that use it as their default route lose egress when that zone or that gateway fails, even though their instances are still up. Place a NAT gateway in each zone that must keep egress, and point that zone private route table at the NAT gateway in the same zone, so a zone failure stays in that zone. More routes to the same gateway add no second device. A zonal NAT gateway lives in one subnet in one zone, so a larger subnet does not stretch it across zones. (AWS also offers a regional NAT gateway that expands across zones on its own, but this question asks you to keep zonal gateways.) A NAT instance with auto-recovery is still one instance in the original zone. Recovery there does not give the other zones a gateway. Caveat: each zone route must target its own NAT gateway. A route that still points at the original gateway will black-hole with it. Operational check: each private route table default route should be the NAT gateway in that same Availability Zone, and those gateways should sit in different zones.