Ensure that your NAT gateways are deployed in at least two Availability Zones (AZs) in order to enable EC2 instances available within private subnets to connect to the Internet or to other AWS services but prevent the Internet from initiating a connection with those instances. AWS Availability Zones are distinct locations that are engineered to be isolated from failures occurred in other zones. Each NAT gateway must be deployed within a specific Availability Zone to receive the redundancy implemented in that zone.
If you have EC2 instances in multiple Availability Zones and these share one NAT gateway, in the event of AZ failure the NAT gateway becomes unavailable and the resources within other Availability Zones lose internet access. To create a fault-tolerant architecture, make sure that your AWS NAT gateways are deployed in at least two Availability Zones (AZs).
Audit
To determine if your Amazon NAT gateways were deployed in at least two Availability Zones, perform the following:
Remediation / Resolution
To deploy your NAT gateways in at least two Availability Zones (AZs), perform the following actions:
References
- AWS Documentation
- What Is Amazon VPC?
- NAT Gateways
- NAT
- NAT Gateways
- CIS Amazon Web Services Foundations
- AWS Command Line Interface (CLI) Documentation
- ec2
- describe-nat-gateways
- describe-subnets
- create-nat-gateway
Unlock the Remediation Steps
Free 30-day Trial
Automatically audit your configurations with Conformity
and gain access to our cloud security platform.
![Confirmity Cloud Platform](/cloudoneconformity/assets/v2/images/common/conformity-platform-cloud.png)
You are auditing:
Create NAT Gateways in at Least Two Availability Zones
Risk Level: Medium