A private subnet's outbound traffic through a single NAT gateway is failing intermittently for connections to one specific busy third-party API endpoint, while traffic to other destinations is unaffected. Monitoring shows the NAT gateway's IP address is hitting its concurrent-connection ceiling for that one destination. What AWS-recommended fix directly raises this specific ceiling for the existing NAT gateway, without changing which subnet or route table the traffic uses?
- Associate additional secondary Elastic IP addresses with the same NAT gateway; each IP address on a NAT gateway supports its own separate pool of concurrent connections to a given unique destination (a specific destination IP, port, and protocol combination), so more addresses raise the effective ceiling
- Increase the NAT gateway's instance type, since NAT gateways run on a selectable EC2 instance type and larger instance types support proportionally more concurrent connections per destination
- Enable VPC Flow Logs on the NAT gateway's network interface, which automatically raises its per-destination connection ceiling once AWS detects sustained legitimate traffic
- Change the route table's default route from the NAT gateway to an internet gateway, since internet gateways have no per-destination connection ceiling
Why A? And why not the others?
Correct answer: A. Associate additional secondary Elastic IP addresses with the same NAT gateway; each IP address on a NAT gateway supports its own separate pool of concurrent connections to a given unique destination (a specific destination IP, port, and protocol combination), so more addresses raise the effective ceiling
Each IP address on a NAT gateway supports up to 55,000 simultaneous connections to a given unique destination, where 'unique destination' means a specific combination of destination IP address, destination port, and protocol; when traffic to one busy destination saturates that ceiling on the gateway's single IP address, AWS supports associating additional secondary IP addresses with the same NAT gateway, and each added address contributes its own 55,000-connection allowance to that destination, directly raising the ceiling without touching subnets or route tables. The instance-type option is wrong because a NAT gateway is a fully managed AWS service, not a customer-managed EC2 instance with a selectable instance type, so there is no instance-type lever to pull. The Flow Logs option is wrong because Flow Logs are a monitoring and diagnostic feature; enabling them only records traffic metadata and has no effect on any connection ceiling. The internet-gateway option is wrong because it would require giving the private subnet's instances public IP addresses and abandon the NAT model entirely, which is not a targeted fix for a per-destination connection ceiling and defeats the purpose of keeping the subnet private.
Source: AWS What's New (Feb 2023): 'Amazon increases NAT Gateway's capacity to support concurrent connections to a unique destination' — up to 55,000 concurrent connections per IP address per unique destination, extendable via additional secondary IP addresses