Private subnets in a city’s VPC lose all outbound internet access when the single shared NAT gateway’s Availability Zone fails. How should the architect remove that SPOF?

Placing a NAT gateway in each Availability Zone that hosts private subnets and routing each private subnet’s egress to the local AZ NAT removes the single point of failure that blacked out a city’s outbound internet when one shared NAT’s AZ failed. The design works because NAT gateways are AZ-scoped: if private subnets in AZ-A send 0.0.0.0/0 to a NAT that lives only in AZ-B, an AZ-B failure breaks egress for AZ-A workloads even though those instances are healthy. AZ-local NATs with matching route tables keep patching, API calls, and telemetry egress available in surviving AZs. That is the standard HA pattern for municipal private-subnet outbound access.

Deleting all route tables and sending private subnet traffic directly to an Internet Gateway fails by concept because private subnets are private precisely because they do not use a direct IGW default route; attaching an IGW path effectively publicizes the model and abandons the private tier design. Replacing every NAT gateway with a single public Elastic IP on each private instance fails because assigning public IPs to “private” instances expands the attack surface, multiplies EIP management, and still does not recreate controlled shared egress HA. Relying on security group egress rules alone without any NAT or egress path redesign fails because security groups filter allowed traffic—they do not provide a route to the internet when the NAT path is gone.

Exam caveat: per-AZ NAT improves availability but increases hourly cost; some cities accept the SPOF for noncritical labs, not for production patching planes. Operational check: inventory private route tables per AZ, ensure each 0.0.0.0/0 targets a NAT in the same AZ, and simulate NAT AZ failure to confirm remaining AZs still reach required AWS and vendor endpoints.