How do you design a cloud network to survive the loss of an availability zone?
Show the answer
Say this first
Use at least two, preferably three AZs. Give every tier a subnet in each AZ, spread instances across them with auto scaling, put load balancers in all of them, and run one NAT gateway per AZ with each private subnet routed to its local one. Use zone-redundant managed services, and avoid anything that pins a tier to one AZ, such as a single NAT gateway or a single-AZ database.
Go deeper
What an AZ is
One or more data centers in a region with separate power, cooling and networking, joined to the other AZs by low-latency links. AZ failures are rare but real; region failures are rarer.
Checklist
- Subnets: public, private and data subnets in each AZ.
- Compute: auto scaling groups across AZs, with enough headroom that two AZs carry the load of three.
- Load balancers: enabled in every AZ that has targets.
- NAT: one NAT gateway per AZ. A single NAT gateway makes every AZ depend on one.
- Data: Multi-AZ databases, replicated caches.
- Hybrid: VPN tunnels and transit gateway attachments already span AZs; make sure the subnets chosen for attachments cover every AZ you use.
AZ names are per account
us-east-1a in one account is not necessarily us-east-1a in another. AWS publishes AZ IDs such as
use1-az1 that are the same everywhere; use them when lining up shared subnets or partner connections.
Azure and GCP
Azure regions with zones expose zones 1, 2 and 3; resources are zonal or zone-redundant. GCP zones such
as us-central1-a and regional managed instance groups play the same role.
They will ask next
Why can three AZs be cheaper than two for the same resilience?
With two AZs each must be able to carry 100% of the load, so you run 200% capacity. With three, each carries 50% after one fails, so you run 150%.
What breaks if every private subnet uses the NAT gateway in AZ a?
When AZ a fails, every AZ loses outbound internet. You also pay inter-AZ charges for all that traffic.
Traps
- Building redundancy at the instance level but leaving a single NAT gateway or single-AZ database.
- Matching AZs between accounts by name instead of AZ ID.