Whether manual _intervention_ is required or not, wouldn't you want _notification_ immediately either NAT box goes down, leaving a SPOF?  If you got notified that one of the production NAT machines (even the backup) went down, wouldn't you want to at least take a look manually to see if the script successfully reset the redundant configuration?  I still maintain that _notification_ is essential when either NAT goes down, which actually doesn't seem contradictory to your comment.  I don't think we want the first notification to arrive when internet connectivity has been lost to the app servers.

Also, we, for one, don't use datadog.  I'm not sure I understand how you intend to use it as a notification channel.  Do you picture it on the NAT instances themselves, on the bastion host, or something else?