Back to All Scenarios
PASSEDcloud / aws_nat
AWS: NAT Gateway Error Spike — Port Allocation Exhaustion
An AWS NAT Gateway is experiencing ErrorPortAllocation events. Private subnet instances cannot make outbound connections.
Pattern
AWS_CLOUD
Expected: AWS_NAT_EXHAUSTION
Severity
HIGH
Confidence
68%
Remediation
Auto-Heal
Test Results
| Metric | Expected | Actual | Result |
|---|---|---|---|
| Pattern Recognition | AWS_NAT_EXHAUSTION | AWS_CLOUD | |
| Severity Assessment | CRITICAL | HIGH | |
| Incident Correlation | N/A | None | |
| Cascade Escalation | N/A | No | |
| Remediation | — | Auto-Heal — Corax resolves autonomously |
Scenario Conditions
AWS NAT Gateway nat-0abc in us-east-1a. Single NAT for entire VPC. 500+ Lambda functions making outbound HTTPS. Port allocation exhausted.
Injected Error Messages (1)
AWS NAT Gateway port exhaustion — nat-0abc ErrorPortAllocation errors, private subnet instances cannot make outbound connections, 500+ concurrent Lambda functions, single NAT gateway bottleneck
Neural Engine Root Cause Analysis
AWS cloud infrastructure event detected — an EC2 instance may be unreachable or in a stopped state, an RDS database is experiencing issues, a load balancer has unhealthy targets, or a Lambda function is failing. AWS service disruptions can cascade across dependent resources and affect application availability.
Remediation Plan
1. Check the AWS Health Dashboard and Personal Health Dashboard for any active service events.
2. For EC2 issues, check instance status checks (system and instance), review CloudWatch metrics, and check VPC security group rules.
3. For RDS, verify database instance status, check storage and connection limits, and review slow query logs.
4. For ELB issues, check target group health checks and verify backend instances are responding.
5. For Lambda, review CloudWatch Logs for invocation errors and check IAM permissions and VPC connectivity.
Improvements Applied
- Pattern classified as AWS_CLOUD (expected AWS_NAT_EXHAUSTION)
- Severity: HIGH (expected CRITICAL)
Tested: 2026-04-02Monitors: 1 | Incidents: 1Test ID: cmnhnr8vc09bylig720bn7rvd