Private subnets in three Availability Zones need resilient IPv4 internet egress. The team wants to avoid cross-AZ NAT traffic and a single-AZ egress dependency. Which design is best?

1. Attach an internet gateway directly to each private instance network interface.
2. Deploy a NAT gateway in each AZ and route each private subnet to its local gateway.
3. Use an S3 gateway endpoint as the default route for all internet destinations.
4. Route all private subnets to one zonal NAT gateway in the first AZ.