Stable egress IPs for multi-region outbound traffic

WHAT THIS TESTS The interviewer wants to see that you can decouple a stable, whitelistable egress identity from the dynamic, autoscaling instances that actually originate traffic across many regions.

A GOOD ANSWER COVERS The problem is that instances behind autoscaling get ephemeral public IPs, which makes allowlisting impossible. The fix is to force outbound traffic through a managed egress point with statically allocated addresses. In each region, place workloads in private subnets and route their internet-bound traffic through a NAT gateway associated with one or more allocated static IPs, such as elastic IPs; the third party then whitelists that small, fixed set. To shrink the allowlist further, centralize egress: route all regions through a shared egress or inspection VPC, often via a Transit Gateway, so traffic from every region exits through a single, small pool of static IPs rather than a per-region set. This central pattern adds cross-region hops and a chokepoint to scale and monitor, but it minimizes the IPs the partner must trust and centralizes firewalling and logging. Whichever pattern you choose, the goals are the same: a small, stable, documented set of source IPs, and no reliance on addresses that change when instances cycle.

COMMON WRONG ANSWERS Assigning public IPs directly to instances, which change as the fleet scales and cannot be reliably whitelisted. Whitelisting an entire cloud provider's IP range, which is enormous and insecure. Forgetting that each region otherwise has its own egress addresses, bloating the allowlist.

LIKELY FOLLOW-UPS How does a NAT gateway preserve a stable source IP? What are the throughput and cost limits of centralized egress? How do you make the egress path highly available?

ONE CONCRETE EXAMPLE Workloads in three regions sit in private subnets and route through a central egress VPC whose NAT gateways carry two elastic IPs. The partner whitelists just those two addresses, and adding a fourth region requires no new allowlist entry.