In AWS, for VPCs, when you create NAT gateway (to provide instances in private subnet ability to talk to internet for software updates but not allow outside initiated inbound calls), for proper HA, you should create a NAT Gatway in a subnet within each Availabiliy Zone, and route traffic from private subnet in the same Availablity Zone to the corresponding NAT Gateway in the same AZ. Why do you need to do this?

So if one AZ goes down, internet access is not disrupted to instances in private subnet in totally seperate AZ.