Managed reliability vs. control — and a hidden single point of failure.
A NAT Gateway is a zonal resource; one NAT serving multiple AZs is a real design mistake.
NAT GatewayNAT Instance
Managed byAWS, zero patchingYou — patch, size, secure it
ScaleAuto, up to 100 GbpsBounded by instance type
Extra softwareNot possiblePossible (proxy, DPI)
One NAT Gateway serving every AZ's private subnets means that AZ's failure takes down every other AZ's outbound internet too. One NAT Gateway per AZ, routed only within that AZ, is the correct pattern.