Gruntwork
-
|
I received the following email from AWS regarding NAT Gateways. As a Reference Architecture customer and Gruntwork VPC module user I would like to know if there is anything I need to do
|
Beta Was this translation helpful? Give feedback.
Replies: 1 comment
-
|
AWS recently sent an email notification about using shared NAT Gateways in VPCs and recommended a separate NAT Gateway for each availability zone (AZ) to ensure high availability and to minimize inter-AZ data transfer costs. How serious is this?First, there is no security implication, underlying module bug, or critical status. If you received the AWS notification, AWS identified an issue where your network configuration could be made more resilient, and we agree with their recommendation. The main downside of not following this recommendation is the possibility that your apps might be unavailable if just one AZ fails, versus multiple AZs failing before your app becomes unavailable. The net effect of this change will be more AWS costs but also more resilience. Gruntwork Reference Architecture CustomersWe found a sub-optimal configuration in the default Reference Architecture where the As a result, we recommend you update your reference architecture configuration prod environment to use multiple NAT Gateways for the To update this configuration, modify the The module itself does not have a bug. The mistake was deploying a Reference Architecture with the wrong value for Find the relevant application VPC Terragrunt configuration in the inputs block in If you also want to add additional NAT Gateways to your management VPC, find the relevant Terragrunt configuration in the inputs block in We tested adding additional NAT Gateways and found that Terraform uses the ReplaceRoute API to update the route table rules. We found that there was no observable downtime or network interruptions while the route table rules were being updated. As AWS mentioned in the email, choose a maintenance window for architecture changes in your VPC. Always test and validate changes in lower environments before deploying to production. Also see: Gruntwork VPC Module UsersFor users who want to configure additional NAT Gateways in a VPC created with the Gruntwork VPC Module, specify the number of gateways you'd like to create with the We tested adding additional NAT Gateways and found that Terraform uses the ReplaceRoute API to update the route table rules. We found that there was no observable downtime or network interruptions while the route table rules were being updated. As AWS mentioned in the email, choose a maintenance window for architecture changes in your VPC. Always test and validate changes in lower environments before deploying to production. Also see: |
Beta Was this translation helpful? Give feedback.
AWS recently sent an email notification about using shared NAT Gateways in VPCs and recommended a separate NAT Gateway for each availability zone (AZ) to ensure high availability and to minimize inter-AZ data transfer costs.
How serious is this?
First, there is no security implication, underlying module bug, or critical status.
If you received the AWS notification, AWS identified an issue where your network configuration could be made more resilient, and we agree with their recommendation. The main downside of not following this recommendation is the possibility that your apps might be unavailable if just one AZ fails, versus multiple AZs failing before your app becomes unavailable. The n…