A media streaming platform runs its transcoding engine on Amazon EC2 instances in private … — AWS Certified Solutions Architect - Professional

A media streaming platform runs its transcoding engine on Amazon EC2 instances in private subnets across $2$ Availability Zones (AZ-A and AZ-B) in the `eu-west-1` Region. The transcoding instances constantly download large raw video files from external Content Delivery Networks (CDNs) on the public internet, process them, and upload them back. Currently, all outbound internet traffic from both private subnets is routed through a single NAT Gateway located in a public subnet in AZ-A.

During peak hours, transcoding instances in AZ-B experience elevated latency, connection timeouts, and packet drops. Network analysis reveals that the single NAT Gateway is hitting its throughput limit of $45\text{ Gbps}$ and experiencing port allocation errors. Additionally, the company is incurring high inter-AZ data transfer charges for all internet-bound traffic originating from AZ-B.

Which architectural modification should a Solutions Architect recommend to optimize network performance, reduce latency, and minimize inter-AZ data transfer costs?

Deploy a new NAT Gateway in a public subnet in AZ-B. Update the route table of the private subnet in AZ-B to route outbound internet traffic ( $0.0.0.0/0$ ) to the new NAT Gateway in AZ-B, while keeping the private subnet in AZ-A routed through the existing NAT Gateway in AZ-A.Answer
B
Keep the single NAT Gateway in AZ-A. Create an AWS Transit Gateway, attach the VPC to the Transit Gateway, and configure a default route ( $0.0.0.0/0$ ) in the private subnet route tables pointing to the Transit Gateway to load-balance traffic to the NAT Gateway.
C
Replace the NAT Gateway in AZ-A with a multi-AZ Application Load Balancer (ALB). Route all outbound internet-bound traffic from the private subnets through the ALB, and request AWS Support to pre-warm the ALB to handle the throughput spikes.
D
Establish an AWS Direct Connect Gateway connection to a central egress VPC that hosts the single NAT Gateway. Update the route tables in the private subnets to route outbound traffic ( $0.0.0.0/0$ ) transitively through the Direct Connect Gateway to the egress VPC.

Answer

Deploy a new NAT Gateway in a public subnet in AZ-B. Update the route table of the private subnet in AZ-B to route outbound internet traffic to the new NAT Gateway in AZ-B, while keeping the private subnet in AZ-A routed through the existing NAT Gateway in AZ-A.

Deploying a dedicated NAT Gateway in each Availability Zone keeps outbound internet traffic local to the subnet's Availability Zone. This eliminates the inter-AZ data transfer fees and reduces latency by removing the cross-AZ network hop. Furthermore, because each NAT Gateway has an independent throughput capacity of up to

45\text{ Gbps}

(and can scale automatically), deploying a second NAT Gateway effectively doubles the overall throughput capability to

90\text{ Gbps}

, resolving the network bottleneck and eliminating port allocation errors.

Step-by-Step Solution

Identify the performance bottleneck and network paths.

Determined that the single NAT Gateway in AZ-A is throughput-limited and causing inter-AZ data transfer latency and charges.

Locating the bottleneck is essential to determine if the issue is NAT capacity or routing hops.

Select the correct target service to resolve NAT throughput limit and inter-AZ latency.

Decided to deploy a dedicated NAT Gateway in AZ-B, keeping the egress traffic local to the Availability Zone.

This scales NAT capacity to

90\text{ Gbps}

globally and eliminates cross-AZ latency and data transfer costs.

Update VPC route tables for localized routing.

Private subnet AZ-A routes to NAT Gateway AZ-A; private subnet AZ-B routes to NAT Gateway AZ-B.

Ensures route paths are zone-specific and optimized.

Key Concept

Multi-AZ NAT Gateway Redundancy and Traffic Localization

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics