Private subnet egress depends on a single NAT Gateway in one Availability Zone. What redesign removes that single point of failure?
Select an answer to reveal the explanation.
Short Explanation
One NAT in one AZ is a single drawbridge—if that island floods, private subnets can’t get out. Put a NAT in each AZ and aim routes locally. Opening every instance to the public internet or banning egress altogether “solves” the wrong problem.
Full Explanation
A NAT Gateway is AZ-scoped; workloads in other AZs that depend on a single NAT lose egress if that AZ fails. The resilient pattern places a NAT Gateway in each AZ that hosts private subnets and uses AZ-local default routes. Making every instance public expands attack surface, and eliminating controlled egress breaks patching and API dependencies. Eliminate the NAT SPOF with multi-AZ NAT and route tables.