From 2fcb5a1d838ebc8ffedce8057e3aa7d60d4eca56 Mon Sep 17 00:00:00 2001 From: kinchit Date: Tue, 27 Oct 2026 16:36:08 +0530 Subject: [PATCH] fix: document skipDefaultNatRoute in the README Add usage docs for the skipDefaultNatRoute option added in #34 (pin a subnet group's egress to a single NAT gateway). This is a releasable commit so the release workflow cuts 0.0.24, which carries #34 and #35; npm 0.0.23 predates them and cannot be republished. Co-Authored-By: Claude Sonnet 5.5 --- README.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/README.md b/README.md index 2374a73..9ff638a 100644 --- a/README.md +++ b/README.md @@ -197,6 +197,29 @@ app.synth(); ``` Please refer [here](/API.md) to check how to use individual resource constructs. +## Pinning egress to a single NAT gateway + +By default every private subnet gets an automatic `0.0.0.0/0` route to the NAT gateway in its own AZ. Set `skipDefaultNatRoute: true` on a subnet group to opt out, and declare your own default route so all AZs of the group egress through one NAT gateway: + +```typescript +{ + subnetGroupName: 'PocSingleNat', + subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS, + cidrBlock: ['10.0.112.0/20', '10.0.128.0/20', '10.0.144.0/20'], + availabilityZones: ['ap-south-1a', 'ap-south-1b', 'ap-south-1c'], + skipDefaultNatRoute: true, + routes: [ + { + routerType: ec2.RouterType.NAT_GATEWAY, + destinationCidrBlock: '0.0.0.0/0', + routerId: 'nat-0123456789abcdef0', // the single NAT gateway + }, + ], +} +``` + +Traffic from the other AZs crosses AZ boundaries to reach that NAT gateway (cross-AZ data charges apply), and that NAT's AZ becomes a single point of failure for the group. + ## Route 53 hosted zones Hosted zones are modeled separately from the `Network` construct. For private