Regional network address translation gateways for cloud computing resources

1 . A system, comprising:

a configuration manager of a cloud computing environment, wherein the cloud computing environment is distributed across multiple geographical regions including a particular region which includes a particular availability zone; and

a set of servers of the cloud computing environment;

wherein the configuration manager is configured to:

create a regional network address translation gateway (RNG) for traffic associated with a virtual private cloud (VPC) of a customer of the cloud computing environment, without requiring the customer to request establishment of availability zone-specific network address translation gateways;

in response to detecting that (a) a particular application resource has been activated using a server of the set of servers on behalf of the customer, wherein the particular application resource is configured within a private subnet of the VPC, and wherein the private subnet is configured within the particular availability zone, and (b) the RNG does not include resources for processing traffic of the particular availability zone, allocate a set of availability zone-specific network function virtualization resources to the RNG to process traffic of the particular availability zone; and

cause routing metadata to be generated and stored such that network packets directed to a set of destinations within the public Internet from the particular application resource are sent via the RNG; and

wherein the RNG is configured to:

utilize the set of availability zone-specific network function virtualization resources to cause a particular network address of the RNG to be set as a source address of a packet originating at the particular application resource prior to delivery of the packet to a destination of the set of destinations.

2 . The system as recited in claim 1 , wherein the configuration manager is further configured to:

create the RNG in response to a programmatic request from the customer.

3 . The system as recited in claim 1 , wherein the configuration manager is further configured to:

receive, via a programmatic interface from the customer, the particular network address of the RNG.

4 . The system as recited in claim 1 , wherein the configuration manager is further configured to:

based at least in part on one or more metrics associated with traffic of the VPC, automatically allocate additional availability zone-specific resources to the RNG to process traffic of the particular availability zone.

5 . The system as recited in claim 1 , wherein the configuration manager is further configured to:

determine, prior to generation of the routing metadata, whether a route from the particular application resource to the destination has already been configured, wherein the routing metadata is generated in response to determining that a route from the particular application resource to the destination has not been configured.

6 . A computer-implemented method, comprising:

establishing a regional network address translation gateway (RNG) for traffic of a virtual private cloud (VPC) of a customer of a cloud computing environment, wherein the cloud computing environment comprises a set of regions, wherein individual ones of the regions comprise one or more availability zones, and wherein the RNG is associated with a particular region of the set of regions;

in response to detecting that (a) a particular application resource has been activated on behalf of the customer within a particular availability zone of the particular region, wherein the particular application resource is configured within the VPC and (b) the RNG does not include resources for processing traffic of the particular availability zone, allocating a first set of resources to the RNG to process traffic of the particular availability zone; and

utilizing the first set of resources of the RNG to cause a particular network address of the RNG to be set as a source address of a packet originating at the particular application resource prior to delivery of the packet to a particular destination.

7 . The computer-implemented method as recited in claim 6 , further comprising:

generating and storing routing metadata such that network packets directed to the particular destination from the particular application resource are sent via the RNG.

8 . The computer-implemented method as recited in claim 7 , wherein said storing the routing metadata comprises storing a route table entry in a route table which is not accessible to the customer.

9 . The computer-implemented method as recited in claim 6 , further comprising:

based at least in part on one or more metrics associated with traffic of the VPC, automatically modifying the first set of resources of the RNG.

10 . The computer-implemented method as recited in claim 9 , wherein said allocating the first set of resources comprises assigning a first group of nodes of a network function virtualization service of the cloud computing environment to the RNG, and wherein said automatically modifying the first set of resources comprises:

assigning one or more additional nodes of the network function virtualization service to the RNG.

11 . The computer-implemented method as recited in claim 9 , wherein said allocating the first set of resources comprises assigning a first set of network addresses including the particular network address to the RNG for use in address translation, and wherein said automatically modifying the first set of resources comprises:

assigning one or more additional network addresses to the RNG for use in address translation.

12 . The computer-implemented method as recited in claim 9 , wherein said automatically modifying the first set of resources comprises:

removing at least one resource from first the set of resources.

13 . The computer-implemented method as recited in claim 6 , further comprising:

allocating a second set of resources to the RNG to process traffic of application resources of the VPC which are configured in another availability zone;

in accordance with a zonal affinity policy,

utilizing the second set of resources of the RNG to perform network address translation for packets originating at application resources in the other availability zone; and

utilizing the first set of resources of the RNG to perform network address translation for packets originating at application resources in the particular availability zone.

14 . The computer-implemented method as recited in claim 6 , wherein said detecting that the particular application resource has been activated comprises one or more of: (a) periodically scanning configuration information of the VPC or (b) subscribing to a stream of VPC configuration change notifications.

15 . The computer-implemented method as recited in claim 6 , wherein the particular application resource comprises a compute instance of a virtualized computing service of the cloud computing environment.

16 . A non-transitory computer-accessible storage medium storing program instructions that when executed on a processor:

establish a regional network address translation gateway (RNG) for traffic of a virtual private cloud (VPC) of a customer of a cloud computing environment, wherein the cloud computing environment comprises a set of regions, wherein individual ones of the regions comprise one or more availability zones, and wherein the RNG is associated with a particular region of the set of regions;

in response to detecting that (a) a particular application resource has been activated on behalf of the customer within a particular availability zone of the particular region, wherein the particular application resource is configured within the VPC and (b) the RNG does not include resources for processing traffic of the particular availability zone, allocate a first set of resources to the RNG to process traffic of the particular availability zone; and

utilize the first set of resources of the RNG to cause a particular network address of the RNG to be set as a source address of a packet originating at the particular application resource prior to delivery of the packet to a particular destination.

17 . The non-transitory computer-accessible storage medium as recited in claim 16 , storing further program instructions that when executed on the processor:

generate and store routing metadata such that network packets directed to the particular destination from the particular application resource are sent via the RNG.

18 . The non-transitory computer-accessible storage medium as recited in claim 16 , storing further program instructions that when executed on the processor:

based at least in part on one or more metrics associated with traffic of the VPC, automatically modify the first set of resources of the RNG.

19 . The non-transitory computer-accessible storage medium as recited in claim 16 , storing further program instructions that when executed on the processor:

receive, from the customer via a programmatic interface, the particular network address.

20 . The non-transitory computer-accessible storage medium as recited in claim 16 , wherein the particular destination comprises one of: (a) a destination in the public Internet, (b) a destination in another VPC, or (c) a destination in a premise of the customer.