Outbound NAT for App Runner has stopped working

Based on the information provided, it appears that your App Runner service is experiencing issues with outbound connections through the NAT gateway, specifically for OAUTH2 traffic, while inbound connections are working fine. Here are some potential reasons and troubleshooting steps to consider:

1. NAT Gateway Configuration: Ensure that the NAT gateway (nat-0d81161b2083effcc) is properly configured and in an "Available" state. Check its status in the Amazon VPC console.

2. Security Group Settings: Verify that the security group associated with your App Runner service allows outbound traffic on the necessary ports for OAUTH2 (typically 443 for HTTPS).

3. Network ACLs: Check if there are any Network ACLs in your VPC that might be blocking the outbound OAUTH2 traffic.

4. VPC Endpoint Configuration: Although you mentioned VPC interface endpoints are active and allowing any-to-any traffic, double-check that they are correctly set up for the services your application needs to access.

5. DNS Resolution: Ensure that DNS hostnames and DNS resolution are enabled for your VPC. This is crucial for proper name resolution, especially for external services like OAUTH2 providers.

6. Route Table: Your route table looks correct with the 0.0.0.0/0 route pointing to the NAT gateway. However, verify that this route table is actually associated with the subnet where your App Runner service is deployed.

7. App Runner VPC Connector: Make sure your App Runner service is correctly configured to use the VPC connector that's associated with your VPC and subnet.

8. CloudWatch Logs: Check the CloudWatch logs for your App Runner service for any error messages related to network connectivity or OAUTH2 failures.

9. VPC Flow Logs: Enable VPC Flow Logs if not already done, and analyze the logs to see if the OAUTH2 traffic is being blocked or routed incorrectly.

10. NAT Gateway Capacity: If you're running a large number of instances or generating high volume of traffic, you might be hitting the NAT gateway's connection limits. Consider monitoring the NAT gateway's CloudWatch metrics.

If these steps don't resolve the issue, you may need to contact AWS support for more in-depth troubleshooting of your specific configuration. They can help identify any potential misconfigurations or limitations in your setup.

Sources
Instances within the private subnet are unable to access the internet using NAT gateway. | AWS re:Post
EKS on VPC using NAT instead of local network | AWS re:Post