In the case of this script,  when the primary is unreachable, the backup takes over the routes as soon as possible.  Once that is done the script will attempt to stop and restart the primary NAT instance.  One thing that I will add in here is to continue to monitor the backup NAT while we are trying to restore the primary one.

I disagree that manual intervention is necessary when only one of the two NATs is down.  As for notifications, I was thinking that for the production systems we would have external notifications/alerts in datadog. If we start using VPCs fro sandboxes, I don't necessarily want a notification for a switch like this in every sandbox but I don't feel to strongly about that so I'm sure you could convince me otherwise if you think it's important.