Production subnets depend on a NAT gateway in another AZ

What's the problem

Subnets route through a NAT gateway in another AZ — that AZ failing cuts outbound access for the others (severity is a 6WAF classification; no matching Security Hub control)

How 6WAF detects it

• Only resources tagged Environment=production or prod are evaluated. Untagged resources are reported as not evaluated, never as passing.
• Severity follows the matching AWS Security Hub control (shown under Reference standard); where no control exists it is labelled as a 6WAF classification.
• Scanning uses an IAM Role you deploy yourself via CloudFormation; AccessDenied or throttling is recorded as not checked and never produces a finding.