What should be done to resolve the issue?
Assign Elastic IP addresses to the instances and create a route from the private subnets to the internet gateway
Delete the NAT instance and replace it with AWS WAF
Disable source/destination checks on the NAT instance
Start/stop the NAT instance so it is launched on a different host
Explanations:
Assigning Elastic IPs to the private instances would make them publicly accessible, which contradicts the requirement to keep them unreachable from the public internet.
AWS WAF (Web Application Firewall) is for managing web traffic filtering and does not address the issue of providing outbound internet connectivity from private instances.
Disabling source/destination checks on the NAT instance allows it to perform as a gateway, enabling outbound internet access for instances in private subnets.
Starting/stopping the NAT instance on a different host does not address the fundamental issue of the NAT instance’s configuration or functionality.
I organize that the answer is:
Disable source/destination checks on the NAT instance