Private subnets in a city’s VPC lose all outbound internet access w…

Question

Private subnets in a city’s VPC lose all outbound internet access when the single shared NAT gateway’s Availability Zone fails. How should the architect remove that SPOF?

Accepted Answer

Place a NAT gateway in each AZ that hosts private subnets and route each private subnet’s egress to the local AZ NAT — One NAT for the whole city is a single fuse. Put a NAT in each AZ and aim each private neighborhood at its local fuse so one AZ outage doesn’t black out outbound patching.

Answer

Delete all route tables and send private subnet traffic directly to an Internet Gateway

Answer

Replace every NAT gateway with a single public Elastic IP on each private instance

Answer

Rely on security group egress rules alone without any NAT or egress path redesign

Private subnets in a city’s VPC lose all outbound internet access when the single shared NAT gateway’s Availability Zone fails. How should the architect remove that SPOF?

Short Explanation

Full Explanation