Delete unused NAT Gateways

A NAT Gateway bills $0.045 per hour the moment it's provisioned — approximately $32.40 per month per gateway — regardless of whether a single byte of traffic passes through it. There is no idle discount, no auto-scaling to zero, and no cost reduction short of deleting the resource. For finance, this is a uniquely clean wastage signal: any gateway with flat-zero CloudWatch traffic metrics is spending real budget on pure overhead.

The question isn't whether to act but how to justify the spend while it remains on the bill. Standard reasons a team might keep an apparently idle NAT include intermittent scheduled workloads (monthly billing runs, quarterly compliance scans) that produce non-zero traffic on cycles longer than the 7-day default monitoring window, or a subnet that is provisioned but not yet deployed to. Each of these is a legitimate, documentable reason — but it should be a recorded decision with an owner, not a default omission.

From a cost-ownership perspective, treating unused NAT Gateways as a tiering question works well: gateways that serve active workloads are a justified networking cost; gateways that serve scheduled or intermittent workloads should be reviewed against a 30-day window and explicitly approved; gateways with no identifiable workload should be deleted. That creates an auditable disposition for every flagged resource rather than a blanket "ignore the small items" posture.

Dana is reviewing the monthly wastage report with the platform team. The tooling has flagged nine NAT Gateways across six accounts — collectively $291 per month in provisioning charges with no traffic on any of them for the last 30 days. Dana's first question is not "can we delete all nine" but "do any of these have a workload that runs on a cycle longer than 30 days?"

The team tags three of the nine as serving monthly batch jobs — the traffic window just missed the run. Dana asks for confirmation using a 45-day lookback and notes them as pending-review with an owner and a review date in the next billing cycle. The other six show no traffic in 45 days across any metric and have no active subnets or ENIs pointing at them; Dana agrees those are clear-cut deletions with no business justification for the spend.

The outcome Dana records for the finance pack: six gateways deleted ($194/month recovered), three under active review with documented owners and a 30-day decision deadline. Each flagged resource now has a disposition rather than a silent line item — and the three pending cases are on a calendar, not left to drift.

The direct cost model is clean: $32.40 per gateway per month in provisioning charges, recurring, with no usage floor. A single idle gateway is a modest line; an estate of 40-odd accounts provisioned with 3 NAT Gateways per VPC by default — with several VPCs per account and a fraction of those NATs serving no active workload — aggregates quickly. The provisioning waste is typically in the range of tens of thousands of dollars per year for mid-sized organisations, and it tends to be persistent because nobody has a specific budget owner for idle networking primitives.

The second financial exposure is the replacement-architecture gap. Active NAT Gateways serving heavy AWS-API traffic (S3, DynamoDB, SQS) carry a $0.045/GB processing charge on every byte. A workload pulling several terabytes per month from S3 through NAT may be paying hundreds of dollars per month in processing fees that a free Gateway Endpoint would eliminate entirely. The wastage flag targets idle gateways; the architectural review is what surfaces overpriced active ones.

For compliance and audit, idle network infrastructure creates a less-obvious cost: unexplained public IP addresses on the architecture diagram. PCI-DSS and SOC 2 reviewers ask about every internet-reachable component. Idle NAT Gateways with no workload attached are the kind of item that triggers an audit finding not because they're dangerous but because they can't be explained — adding clean-up time and scope-creep risk to an audit that could otherwise be tight.

A NAT Gateway costs roughly $32 per month whether or not any traffic flows through it. An unused one is straightforwardly a fixed cost with no return — the networking equivalent of paying rent on an empty office. The wastage check identifies gateways where CloudWatch metrics show no traffic for a meaningful period.

At a single-gateway level the number is small. At scale — large organisations commonly have hundreds of VPCs, each provisioned with multiple NAT Gateways by default — it compounds. The leadership question is whether the estate has a policy for reviewing and disposing of idle networking infrastructure, or whether these charges accumulate unexamined. The fix itself is simple; the governance question is whether it happens systematically.

At one company the quarterly infrastructure audit kept surfacing the same pattern: dozens of NAT Gateways flagged as idle, a mixed response from teams, and no central record of what had been reviewed or why anything was left running. The aggregate charge was modest per line item but over $15,000 per year when totalled across the estate.

The change wasn't technical — it was a process. Each flagged gateway had to have a named owner, a 30-day window for a disposition decision (delete, approved-exception, or under-active-review), and a recorded reason. Exceptions were visible in the finance dashboard, not buried in a suppressed-findings list that nobody read.

Within two quarters the idle NAT charge dropped by over 80%. More importantly, new idle gateways stopped accumulating — because the review process created enough friction that teams started deprovisioning NAT infrastructure when they decommissioned workloads, rather than leaving the plumbing running and assuming it was small enough to ignore.

The cost is real but easy to underestimate from the top. At $32 per gateway, any individual item looks trivial. The pattern becomes significant when the number is multiplied by default provisioning practices (three NATs per VPC, several VPCs per account, dozens of accounts) and by the fact that nobody reviews them unless prompted. Organisations commonly discover five-figure annual charges on NAT Gateway provisioning that a systematic quarterly review would have caught and cleared.

There is also a risk and compliance dimension. Idle NAT Gateways hold public IP addresses that appear on security audit scopes. For any organisation under PCI-DSS, SOC 2, or similar frameworks, unexplained public endpoints add audit surface and explanation burden — a cost that doesn't show on the infrastructure bill but consumes team time. The leadership question is whether there is a standing process for reviewing and clearing idle network infrastructure, or whether the bill and the audit scope both grow by default.