Private subnets in two Availability Zones must call external APIs.
Outbound access must continue if one Availability Zone fails.
Which configuration is most appropriate?
Place a NAT Gateway in a public subnet in each Availability Zone and route each private subnet to the local gateway.
Detailed explanation
The single gateway becomes a failure point and introduces cross-AZ traffic when other subnets use it.
The single gateway becomes a failure point and introduces cross-AZ traffic when other subnets use it.
DNS failover does not create or replicate NAT Gateway resources.
DNS failover does not create or replicate NAT Gateway resources.
Separate NAT gateways reduce cross-AZ dependencies and keep outbound paths available during an AZ failure.
Separate NAT gateways reduce cross-AZ dependencies and keep outbound paths available during an AZ failure.
A gateway endpoint is for supported AWS services such as S3, not arbitrary internet APIs.
A gateway endpoint is for supported AWS services such as S3, not arbitrary internet APIs.
Check official documentation
Compare the following points with the official documentation.
AWS VPC NAT Gateway high availability best practicesの公式説明を確認する。
What to confirm
NAT GatewayのAZ単位配置と単一共有構成の可用性差を説明できる。
Key points
- NAT Gateway
- Availability Zone redundancy
- Private route
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Local egress
Routing each subnet to a same-AZ NAT Gateway reduces cross-AZ dependency and transfer.
Failure domain
A single NAT Gateway limits availability to its own Availability Zone.