⚡ ~/naveed Interview Prep
⚡ Portfolio Home ✍️ Engineering Blog Deep Dives 🎯 Interview Hub 998+ Scenarios ☸️ Kubernetes Mastery Hub 24 Modules 🎮 DevOps Arcade & Quizzes Subnet Blitz ⚡ 🗺️ DevOps Roadmaps PDFs & Guides 🤖 Morpheus Analysis AI Quant ↗ 🛠️ Developer Tools Utilities 🧪 Labs & Experiments 📄 Interactive CV & Certs 🔗 All Links & Socials ⚡ Join The Dispatch (Weekly SRE Newsletter) →
Staff SRE / Principal Architect [L3] AWS Cost & Architecture Staff SRE Scenario [L3]

Q: A fleet of 5,000 Lambda functions in a private VPC aggressively scrape data from the public internet. Randomly, hundreds of them begin crashing with bizarre `Connection Timed Out` networking errors, despite the internet destination being perfectly healthy. What AWS bottleneck is occurring?

This is classic SNAT (Source Network Address Translation) Port Exhaustion on the NAT Gateway.

#AWS #Cost & Architecture #L3 #Cloud #Infrastructure #VPC
🎙️ Candidate Opening & Architectural Context
""When an interviewer asks how I troubleshoot this in AWS, I frame it through my hands-on production experience. The interviewer is testing: NAT Gateway SNAT Port Exhaustion.. I structure my answer around systematic triage first, root cause analysis second, and permanent remediation third.""
Advertisement

🛠️ Production Runbook & Step-by-Step Resolution

1️⃣

Production Solution & Architecture

This is classic SNAT (Source Network Address Translation) Port Exhaustion on the NAT Gateway. A single AWS NAT Gateway utilizes a single public Elastic IP. TCP allows a theoretical maximum of ~65,000 ephemeral outbound ports per IP addressing a single destination. When 5,000 highly concurrent Lambda functions open thousands of individual API connections to the exact same external internet API simultaneously, the NAT Gateway completely runs out of ephemeral routing ports. It violently drops any new outbound connection attempts until old ones close. *Fix:* Heavily deploy multiple NAT Gateways across multiple public subnets and route traffic dynamically to distribute the SNAT allocation, or deploy dedicated NAT instances.

💡 The Senior SRE Gold Nugget (Key Architectural Takeaway)
"Pro-Tip: This is classic SNAT (Source Network Address Translation) Port Exhaustion on the NAT Gateway.."
⚡ 60-Second Elevator Pitch Talking Points
  • Immediate Triage: This is classic SNAT (Source Network Address Translation) Port Exhaustion on the NAT Gateway.
  • Run targeted verification commands before modifying configuration.
  • Automate permanent guardrails (CI check, alerts, IaC policy) to prevent recurrence.
Advertisement
Want more AWS scenarios?
Explore our complete collection of scenario-based AWS interview runbooks.
Browse All AWS Questions →

📚 Related Production Scenarios in AWS