A VPC has private subnets in three Availability Zones, all currently routing their internet-bound traffic to a single NAT gateway that lives in one Availability Zone's public subnet. What does AWS recommend to make this design more resilient, and what is the tradeoff of not doing so?
- Nothing needs to change; a single NAT gateway is already redundant across all Availability Zones in the Region
- Deploy a separate NAT gateway in each Availability Zone's public subnet and route each private subnet to the NAT gateway in its own AZ; otherwise, an outage of the single NAT gateway's AZ takes down internet access for every private subnet, and cross-AZ traffic to reach it incurs inter-AZ data transfer charges
- Replace the NAT gateway with a NAT instance, since NAT instances are inherently more available across Availability Zones
- Attach a second Elastic IP address to the existing NAT gateway so it can serve two Availability Zones redundantly
Why B? And why not the others?
Correct answer: B. Deploy a separate NAT gateway in each Availability Zone's public subnet and route each private subnet to the NAT gateway in its own AZ; otherwise, an outage of the single NAT gateway's AZ takes down internet access for every private subnet, and cross-AZ traffic to reach it incurs inter-AZ data transfer charges
AWS's own guidance states NAT gateways in each Availability Zone are implemented with redundancy, but recommends you 'create a NAT gateway in each Availability Zone to ensure zone-independent architecture' — a single NAT gateway is redundant only within its own AZ, not across AZs, so relying on one NAT gateway for a multi-AZ VPC creates a single point of failure and also routes cross-AZ traffic that incurs inter-AZ data transfer charges. Option A is wrong because AWS does not automatically stretch a single NAT gateway's availability across multiple AZs — it explicitly lives in one AZ's subnet. Option C is wrong because NAT instances require the customer to script their own failover and are generally less available than NAT gateways, not more. Option D is wrong because a NAT gateway supports only a fixed set of Elastic IPs for its own outbound traffic and has no mechanism to 'serve' a second Availability Zone by adding an address.
Source: AWS VPC docs: Compare NAT gateways and NAT instances — Availability