Private subnets in several AZs need outbound internet access.
Maintain AZ availability and reduce unnecessary cross-AZ transfer.
Choose TWO appropriate design elements.
Deploy NAT Gateways per AZ for local egress and use gateway endpoints for S3 and DynamoDB to avoid unnecessary NAT processing and cross-AZ paths.
Detailed explanation
A shared gateway can add cross-AZ charges and a single-AZ dependency.
A shared gateway can add cross-AZ charges and a single-AZ dependency.
An internet gateway does not provide private outbound-only access and expands exposure.
An internet gateway does not provide private outbound-only access and expands exposure.
Service-specific private paths avoid NAT processing for those services.
Service-specific private paths avoid NAT processing for those services.
AZ-local NAT reduces dependency on another AZ and avoids cross-AZ egress paths.
AZ-local NAT reduces dependency on another AZ and avoids cross-AZ egress paths.
Check official documentation
Compare the following points with the official documentation.
AWS VPCのNAT Gateway配置とGateway Endpointの公式説明を確認する。
What to confirm
AZ障害、AZ間転送、AWSサービス向け専用経路を比較できる。
Key points
- NAT Gateway per AZ
- Gateway VPC Endpoint
- Cross-AZ transfer
Notes
- Environment: AWS公式VPCドキュメントの確認
- Confirm current AWS pricing and service behavior in the official documentation.
Foundation review
Availability and cost
Per-AZ NAT improves isolation, while endpoints avoid unnecessary NAT and cross-AZ processing for supported services.
Route design
Each private subnet's route table should point to the local egress or service endpoint as appropriate.