But that's another thing to keep patched. I wonder if it would be feasible, when using a stripped-down container host OS like Bottlerocket, to configure one co

But that's another thing to keep patched. I wonder if it would be feasible, when using a stripped-down container host OS like Bottlerocket, to configure one container host instance per availability zone to also do NAT. Note that I'm assuming a setup where the containers are running in ECS tasks that use the awsvpc network mode (i.e. each task has its own VPC network interface and private IP address), so security groups can be fine-grained. So even the tasks running on container hosts that do NAT would need the NAT.