Idle NAT gateways, and traffic a VPC endpoint would carry for free
A NAT gateway bills by the hour whether or not anything flows through it, then bills again per GB processed — including for traffic that never needed to go through it.
What this problem is
The NAT gateway is one of the few AWS resources that charges you twice: a flat hourly rate for as long as it exists, and a separate per-gigabyte rate for everything it processes. The first accrues even when nothing is flowing. The second grows quietly, because nobody watches the egress volume of a private subnet until the invoice lands.
Two distinct kinds of waste hide here. One is the leftover gateway: a subnet was retired, a staging environment was torn down, and the NAT stayed up with no route table pointing at it — billing hours to serve nobody. The other is subtler and usually larger: traffic to S3 and DynamoDB leaving through the NAT when a gateway VPC endpoint would carry the same traffic at no per-GB charge.
The second case is common precisely because the default works. An application in a private subnet reading from an S3 bucket reaches it through the NAT with no configuration at all, and nothing breaks — it is only expensive. A gateway VPC endpoint for S3 or DynamoDB has no hourly and no per-GB charge, and whatever flows through it disappears from the NAT bill.
How we detect it
We list the account's NAT gateways with DescribeNatGateways and the route tables with DescribeRouteTables, which reveals the gateways no route points at. For traffic, we read the bytes-processed metrics the NAT itself publishes to CloudWatch, per gateway and per region.
- NAT gateway data that a VPC endpoint would save
- Orphan NAT gateways
What it costs
A NAT gateway runs about $0.045 per hour — roughly $33 a month just to exist — plus about $0.045 per GB processed (us-east-1). A gateway VPC endpoint for S3 or DynamoDB has no hourly charge and no per-GB charge.
Public AWS list prices, us-east-1, subject to change. The figure in your report is computed against your resources in your regions.
How it appears in the report
An illustrative example, with invented resources and figures. In the report each finding carries the real resource, its region, and the fix command where a safe one exists.
Does your account have this?
The scan is read-only and shows you what it found before you pay for anything.
Run a free scan