Question

A company runs a workload across three private subnets in three Availability Zones (AZ-a, AZ-b, AZ-c) within a single VPC. Instances in all three subnets need outbound internet access for software updates. The networking team initially deployed one NAT gateway in AZ-a's public subnet and pointed the route tables of all three private subnets to it. During a recent AZ-a service event, instances in AZ-b and AZ-c also lost outbound connectivity. The team wants to eliminate this cross-AZ dependency while following AWS best practices. What should they implement?

Accepted Answer

Deploy a NAT gateway in a public subnet in each of the three AZs, and update each private subnet's route table to send 0.0.0.0/0 to the NAT gateway in its own AZ.

Answer

Deploy two additional NAT gateways in AZ-a and configure the private subnet route tables to load balance across all three NAT gateways in AZ-a.

Answer

Replace the NAT gateway with a NAT instance in AZ-a and enable source/destination check so all AZs continue to route through it.

Answer

Attach an egress-only internet gateway to the VPC and route all three private subnets' 0.0.0.0/0 traffic to it.