CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Designing Outbound Internet Access for Private Subnets
Learn how to approach AWS exam questions regarding NAT Gateways and redundancy for private subnets.
Instances in private subnets across two AZs need outbound internet access that remains available if one AZ fails. This design decision often trips candidates.
The question
Instances in private subnets across two AZs need outbound internet access that remains available if one AZ fails. What is the recommended design?
- A. A single NAT Gateway in one AZ
- B. A NAT Gateway in each AZ with route tables pointing local subnets to their AZ NAT Gateway
- C. An Internet Gateway attached to the private subnets
- D. A NAT instance with no redundancy
Think before you scroll
Consider the requirement for high availability. The solution must ensure that if one Availability Zone (AZ) fails, the instances in the other AZ still maintain outbound internet access.
The answer
B. A NAT Gateway in each AZ with route tables pointing local subnets to their AZ NAT Gateway. This option provides redundancy and maintains internet access despite the failure of one AZ. Each private subnet routes traffic through its own NAT Gateway, ensuring that if one fails, the other remains operational.
Why the other options lose
A. A single NAT Gateway in one AZ: This option creates a single point of failure. If the AZ with the NAT Gateway fails, instances in both AZs lose outbound internet access.
C. An Internet Gateway attached to the private subnets: Internet Gateways are only for public subnets. Private subnets need NAT Gateways to enable outbound access while keeping the instances secure from direct internet access.
D. A NAT instance with no redundancy: Similar to option A, this lacks redundancy. If the NAT instance fails, all outbound internet access is lost for the private subnets. NAT instances also do not scale as well as NAT Gateways.
The concept behind it
Always design for failure. In cloud architecture, especially with AWS, assume that components can fail. By deploying redundant components across multiple AZs, you ensure that your application remains resilient and highly available. NAT Gateways provide a fully managed solution for enabling outbound internet access while maintaining security for private subnets.
Exam trap to remember
Remember: for high availability in multi-AZ deployments, always deploy redundant components and avoid single points of failure.