Port Exhaustion
Running out of available source ports for outbound connections through a NAT device, causing new connections to fail while everything appears healthy.
A NAT gateway can hold roughly 55,000 simultaneous connections per destination address and port. Workloads that open many short-lived connections to a single endpoint — a shared database, an API gateway, an object store accessed without a private endpoint — approach that ceiling.
The symptoms are distinctive and misleading: intermittent connection timeouts, errors that correlate with load rather than with any change, and a destination that is demonstrably healthy.
The fixes, in order: connection pooling and keep-alive, so far fewer connections are opened; private endpoints for cloud services, which bypass NAT entirely and usually cost less as well; multiple NAT gateways (one per zone is the standard pattern anyway, and it multiplies the ceiling); and closing connections promptly so table entries free up.
Monitor the NAT gateway's port allocation error metric — it exists precisely for this and is rarely on a dashboard.