Several lightly used AZ-local NAT Gateways in a parks-and-recreation VPC drive fixed hourly charges. Some architects want one shared NAT to save money; others worry about losing AZ isolation for egress during an AZ event. Which recommendation best balances cost and reliability?

Lightly used AZ-local NAT Gateways in a parks-and-recreation VPC create fixed hourly charges, but collapsing blindly can sacrifice AZ-independent egress during an AZ event. The balanced recommendation is to consolidate underused NAT Gateways only where Multi-AZ egress isolation is not required, keep per-AZ NAT for workloads that must retain AZ-independent outbound paths, and document the reliability tradeoff for the architecture board. That respects both FinOps and resilience for civic parks systems. Deleting all NAT Gateways and requiring public IPs on every private-subnet instance fails because it abandons private-subnet posture and expands the attack and mismanagement surface. Consolidating to a single NAT Gateway in one AZ for all production and non-production traffic with no further analysis fails by ignoring workloads that need AZ-independent egress and by mixing prod/non-prod risk. Replacing every NAT Gateway with an Internet Gateway attached to private subnets fails conceptually: private subnets are not designed to route 0.0.0.0/0 to an IGW on the instance path the same way, and the pattern breaks private networking assumptions rather than solving hourly NAT cost thoughtfully. Exam caveat: NAT consolidation is a documented cost/reliability tradeoff—not an all-or-nothing delete. Operational check: classify subnets by required AZ egress independence, merge NAT only for eligible noncritical paths, keep per-AZ NAT for critical tiers, measure hourly NAT charges before/after, and record the tradeoff in the parks VPC design ADR.