Why One Subnet Is Never Enough
An Availability Zone (AZ) is a physically separate data center (or cluster of data centers) within a cloud region. Each AZ has independent power, cooling, and networking. If one AZ experiences an outage, the others continue operating.
A subnet in a VPC is always tied to a single AZ. If you deploy all your resources in one subnet (one AZ) and that AZ goes down, your entire application goes down with it.
Multi-AZ design means replicating your subnet structure across multiple AZs. A typical production VPC in a region with three AZs looks like this:
| Subnet | AZ | CIDR | Type |
|---|---|---|---|
| public-subnet-1a | us-east-1a | 10.0.1.0/24 | Public |
| public-subnet-1b | us-east-1b | 10.0.2.0/24 | Public |
| public-subnet-1c | us-east-1c | 10.0.3.0/24 | Public |
| private-subnet-1a | us-east-1a | 10.0.11.0/24 | Private |
| private-subnet-1b | us-east-1b | 10.0.12.0/24 | Private |
| private-subnet-1c | us-east-1c | 10.0.13.0/24 | Private |
Your load balancer spans all three public subnets. Your application servers are distributed across all three private subnets. If us-east-1b fails, traffic automatically routes to instances in 1a and 1c.
The NAT Gateway AZ Trap
A NAT Gateway lives in a specific AZ. If your private subnets in us-east-1a, 1b, and 1c all route outbound traffic to a single NAT Gateway in us-east-1a, and that AZ fails, all three private subnets lose internet access simultaneously — even though 1b and 1c are still healthy.
The correct pattern: deploy one NAT Gateway per AZ, and configure each AZ's private subnets to use their local NAT Gateway. This costs more (three NAT Gateways instead of one), but eliminates cross-AZ dependency for outbound traffic.