A startup is deploying a payment processing application in a VPC across three Availability Zones. The application instances reside in private subnets and must connect to external payment APIs over the internet. The architecture must protect these instances from inbound internet traffic and survive the failure of any single Availability Zone. Which of the following networking designs should the solutions architect select?
- ADeploy a single NAT Gateway in a public subnet in one Availability Zone, and configure the route tables of all private subnets across all zones to direct outbound internet traffic to this single NAT Gateway.
- Deploy one NAT Gateway in a public subnet within each Availability Zone, and configure the route tables of the private subnets to direct outbound internet traffic to the NAT Gateway in the same zone.Answer
- CDeploy a Direct Connect Gateway to establish transitive routing between the VPC private subnets and a shared services VPC containing a single NAT Gateway, directing all outbound traffic through the Direct Connect Gateway.
- DDeploy a NAT Gateway in a shared services VPC and create a Route 53 Private Hosted Zone for the external API endpoints, without associating the hosted zone with the application VPC.
Answer
Deploy one NAT Gateway in a public subnet within each Availability Zone, and configure the route tables of the private subnets to direct outbound internet traffic to the NAT Gateway in the same zone.
Deploying a NAT Gateway in each Availability Zone ensures that if one zone experiences an outage, instances in the remaining zones can still access the internet through their local NAT Gateways. This provides high availability and resilience.
Step-by-Step Solution
Key Concept
NAT Gateway redundancy across multiple Availability Zones to ensure high availability and prevent single points of failure.
Estimated Time:1m 0s