diff --git a/API.md b/API.md
index 1f5a8e2..bf09cd0 100644
--- a/API.md
+++ b/API.md
@@ -3581,6 +3581,7 @@ public readonly routeTableId: string;
| ingressNetworkACL | NetworkACL[] | *No description.* |
| routes | AddRouteOptions[] | *No description.* |
| routeTableStringFormat | boolean | *No description.* |
+| skipDefaultNatRoute | boolean | Do not add the automatic default route (0.0.0.0/0) to the same-AZ NAT gateway for the private subnets of this group. Declare your own 0.0.0.0/0 route in `routes` (e.g. RouterType.NAT_GATEWAY with a routerId) to pin egress to a specific NAT gateway. |
| tags | {[ key: string ]: string} | *No description.* |
| useNestedStacks | boolean | *No description.* |
| useSubnetForNAT | boolean | *No description.* |
@@ -3667,6 +3668,19 @@ public readonly routeTableStringFormat: boolean;
---
+##### `skipDefaultNatRoute`Optional
+
+```typescript
+public readonly skipDefaultNatRoute: boolean;
+```
+
+- *Type:* boolean
+- *Default:* false
+
+Do not add the automatic default route (0.0.0.0/0) to the same-AZ NAT gateway for the private subnets of this group. Declare your own 0.0.0.0/0 route in `routes` (e.g. RouterType.NAT_GATEWAY with a routerId) to pin egress to a specific NAT gateway.
+
+---
+
##### `tags`Optional
```typescript
diff --git a/src/constructs/network.ts b/src/constructs/network.ts
index 73c722e..48ef478 100644
--- a/src/constructs/network.ts
+++ b/src/constructs/network.ts
@@ -70,6 +70,15 @@ export interface ISubnetsProps {
readonly routeTableStringFormat?: boolean;
readonly tags?: Record;
readonly useSubnetForNAT?: boolean;
+ /**
+ * Do not add the automatic default route (0.0.0.0/0) to the same-AZ NAT gateway
+ * for the private subnets of this group. Declare your own 0.0.0.0/0 route in
+ * `routes` (e.g. RouterType.NAT_GATEWAY with a routerId) to pin egress to a
+ * specific NAT gateway.
+ *
+ * @default false
+ */
+ readonly skipDefaultNatRoute?: boolean;
readonly useNestedStacks?: boolean;
}
export interface VPCProps {
@@ -157,7 +166,7 @@ export class Network extends Construct {
subnet.forEach((sb) => {
if (sb instanceof ec2.PublicSubnet) {
this.pbSubnets.push(sb);
- } else if (sb instanceof ec2.PrivateSubnet) {
+ } else if (sb instanceof ec2.PrivateSubnet && !subnetProps.skipDefaultNatRoute) {
this.pvSubnets.push(sb);
}
if (