What strategies did you use to architect secure VPCs with multi-AZ subnets and NAT Gateways?