An application runs across hundreds of EC2 instances in three Availability Zones and calls a third-party API on the internet. The third party requires a fixed list of source IP addresses to whitelist. Which design will provide a set of static outbound IPs for the traffic?

Creating a NAT Gateway in each Availability Zone (AZ) and configuring private subnets to route internet-bound traffic through them is the correct solution. Each NAT Gateway is assigned a static Elastic IP address. When instances in private subnets send traffic to the internet, it egresses through the NAT Gateway's Elastic IP, providing a fixed, public source IP address for whitelisting by the third party. This design also ensures high availability and fault tolerance across AZs. Allocating an Elastic IP to every instance is impractical and doesn't provide a consolidated list of IPs. Putting instances behind an NLB is for inbound traffic distribution, not for controlling outbound source IPs. Changing the main route table to route through an Elastic IP attached to each instance would require each instance to have a public IP, which is not ideal for security and doesn't consolidate the source IPs.