Create NAT Gateways in at Least Two Availability Zones

01 Sign in to the AWS Management Console.

02 Navigate to VPC dashboard at https://console.aws.amazon.com/vpc/.

03 Select the Virtual Private Cloud (VPC) that you want to examine from the Select a VPC dropdown menu.

04 In the navigation panel, under Virtual Private Cloud, click NAT Gateways. If there is just one NAT gateway deployed, all the EC2 instances within private subnets share the same gateway, therefore the architecture is not compliant.

05 Select the NAT gateway that you want to examine.

06 Select the Details tab from the dashboard bottom panel.

07 On the Details panel, click on the subnet ID (link) assigned to the Subnet configuration attribute to access the subnet resource where the selected NAT gateway was created.

08 On the Summary panel, verify the value set for the Availability Zone attribute to identify the AZ where the selected subnet resides.

09 Repeat steps no. 4 – 8 to check the other gateways available within the selected region (if any) for the Availability Zone used. If the verified NAT gateways were deployed within subnets that share the same Availability Zone, the architecture used is not compliant.

10 Change the AWS region from the navigation bar and repeat steps no. 4 – 9 for other regions.

01 Run describe-nat-gateways command (OSX/Linux/UNIX) using custom query filters to describe all the NAT gateways deployed inside your VPC and list the subnets used at deployment:

aws ec2 describe-nat-gateways
	--region us-east-1
	--filter Name=vpc-id,Values=vpc-12345678
	--query "NatGateways[*].{NatGatewayId:NatGatewayId, SubnetId:SubnetId}"

02 If the command output returns the metadata for just one NAT gateway, the EC2 instances available within private subnets share the same gateway, therefore the architecture is not compliant. Otherwise, the command output should return the ID and the subnet ID of each NAT gateway deployed within the selected VPC, as shown in the example above:

[
    {
        "SubnetId": "subnet-1234abcd",
        "NatGatewayId": "nat-01234567890abcabc"
    },
    {
        "SubnetId": "subnet-abcd1234",
        "NatGatewayId": "nat-01234567890bcabca"
    }
]

03 Run describe-subnets command (OSX/Linux/UNIX) using the IDs of the VPC subnets returned at the previous steps as identifiers and custom query filters to describe the Availability Zones where the specified subnets were created:

aws ec2 describe-subnets
	--region us-east-1
	--subnet-ids subnet-1234abcd subnet-abcd1234
	--query "Subnets[*].{SubnetId:SubnetId, AvailabilityZone:AvailabilityZone}"

04 The command output should return the Availability Zones (AZs) where the NAT gateway subnets were deployed:

[
    {
        "SubnetId": "subnet-1234abcd",
        "AvailabilityZone": "us-east-1d"
    },
    {
        "SubnetId": "subnet-abcd1234",
        "AvailabilityZone": "us-east-1d"
    }
]

05 Change the AWS region by updating the --region command parameter value and repeat steps no. 1 – 4 for other regions.

01 Sign in to the AWS Management Console.

02 Navigate to VPC dashboard at https://console.aws.amazon.com/vpc/.

03 Select the Virtual Private Cloud (VPC) that you want to examine from the Select a VPC dropdown menu.

04 In the navigation panel, under Virtual Private Cloud, click NAT Gateways.

05 Click Create NAT Gateway button from the dashboard top menu to initiate the setup process.

06 On Create NAT Gateway page, perform the following:

1. Click inside the Subnet box and select the public subnet in which the new NAT gateway will reside.
2. Click inside the Elastic IP Allocation ID box and select the Elastic IP address to associate with the NAT gateway at deployment. If there are no Elastic IPs (EIPs) available, click Create New EIP to allocate a new one and associate it automatically with the gateway.
3. Click Create a NAT Gateway to deploy your new NAT gateway. If successful, the following message should be returned: "Your NAT gateway has been created. NAT Gateway ID: <GATEWAY_ID>." The new gateway will enable EC2 instances inside your private subnets to communicate with the Internet. Click Close to return to the VPC dashboard.

07 Repeat step no. 5 and 6 to create more Amazon NAT gateways (at least one more in a different AZ), inside the selected VPC, within the current AWS region.

08 If necessary, change the AWS region from the navigation bar and repeat steps no. 5 – 7 for other regions.

01 Run create-nat-gateway command (OSX/Linux/UNIX) to create a new NAT gateway inside the specified subnet (preferred AZ) and associate it with an Elastic IP address. The following command example creates a NAT gateway within a VPC subnet identified by the ID "subnet-abcd1234", using an Elastic IP address identified by the ID "eipalloc-1234abcd", in the US East (N. Virginia) region:

aws ec2 create-nat-gateway
	--region us-east-1
	--subnet-id subnet-abcd1234
	--allocation-id eipalloc-1234abcd

02 The command output should return the new NAT gateway metadata:

{
    "NatGateway": {
        "NatGatewayAddresses": [
            {
                "AllocationId": "eipalloc-1234abcd"
            }
        ],
        "VpcId": "vpc-12345678",
        "State": "pending",
        "NatGatewayId": "nat-01234567890dddeee",
        "SubnetId": "subnet-abcd1234",
        "CreateTime": "2018-04-12T16:52:42.000Z"
    }
}

03 Change the --subnet-id parameter value (i.e. subnet ID) and repeat step no. 1 to create more AWS NAT gateways (at least one more in a different Availability Zone), within the selected AWS region.

04 If necessary, change the AWS region by updating the --region command parameter value and repeat steps no. 1 – 3 for other regions.