All cheat sheets
Cost Governancecheat sheet

Trusted Advisor — Unutilized NAT Gateways

A NAT Gateway costs ~$32/month per AZ just to exist — a 3-AZ VPC is $96/month before a byte flows. Trusted Advisor lists the near-zero-traffic ones; delete them (and release the EIP underneath), and replace AWS-service egress with VPC Endpoints.

Last reviewed: July 14, 2026

Prefer step by step? Take the guided Trusted Advisor — Unutilized NAT Gateways walkthrough — free, anonymous, interactive.Have an AI assistant? Jump to the copy-paste audit prompt at the bottom of this sheet.

TL;DR: NAT Gateways are the most expensive "default" choice in AWS VPC design: ~$32/month per gateway per AZ regardless of traffic (a 3-AZ VPC is $96/month before a byte flows), plus $0.045/GB processed on top. There's no "smaller" version — the only knob is exists-or-not. Trusted Advisor lists the ones live 30+ days with near-zero traffic; delete them, release the EIP underneath, and for VPCs whose egress is mostly to AWS services, replace NAT with VPC Endpoints entirely.

The numbers

  • ~$32/month per NAT per AZ, traffic-independent — a mature account with 5–10 VPCs easily carries 20–30 NAT Gateways = $600–1,000/month in hourly charges alone.
  • Data processing adds $0.045/GB on top — often the dominant cost for ECR- or CloudWatch-Logs-heavy workloads.
  • VPC Endpoints: gateway endpoints (S3, DynamoDB) are free; interface endpoints are ~$7.20/month per AZ + $0.01/GB — cheaper than NAT when they let you delete it or slash data processing.
  • Typical finding: 5–15 unutilized NAT Gateways = $200–500/month recovered by deletion; endpoint replacement adds $100–500/month more.
  • Field examples: a 7-VPC company deleted 11 NATs (abandoned + over-provisioned) for $320/mo ($3,840/yr) and cut VPCs 7→4; an ECR-heavy CI pipeline dropped NAT data from 3 TB to ~200 MB/month with 3 interface endpoints + the free S3 gateway endpoint (~$1,200/yr plus a security-audit win).

Do this

  1. Confirm the VPC is truly idle — no live EC2/Lambda/ECS/RDS needing egress (describe-instances --filters Name=vpc-id,...); an empty VPC's NAT has no caller.
  2. Delete the NAT, then release its Elastic IP — the EIP doesn't auto-release and would bill ~$3.65/month as unassociated; clean up dangling route-table entries too.
  3. Drop non-prod to single-AZ NAT — dev/staging/sandbox tolerate an AZ outage; match NAT AZ-redundancy to the workload's own redundancy (multi-AZ NAT for a single-AZ workload is wasted).
  4. Replace AWS-service egress with VPC Endpoints — read VPC Flow Logs on the NAT ENI to classify destinations; deploy free gateway endpoints (S3, DynamoDB) and interface endpoints (ECR, CloudWatch Logs, SSM), then delete NAT if no non-AWS egress remains.
  5. Fix cross-VPC-through-NAT traffic — two same-Org VPCs talking via the internet should use peering or Transit Gateway, not pay NAT egress + ingress.

Gotchas

  • The EIP is the forgotten cost — deleting the NAT leaves the Elastic IP billing; always release it.
  • Route tables persist after deletion — stale routes to a deleted NAT break traffic on redeploy; clean them up.
  • Re-pointing a subnet to a NAT in another AZ adds cross-AZ transfer (~$0.01/GB) — factor it when consolidating.
  • NAT Gateways can't be paused (unlike RDS) — delete is full delete, recreate gets a new IP unless you re-assign the EIP.
  • Legacy NAT instances aren't flagged — this check covers managed NAT Gateways only.

Skip this if

Run this audit with your AI assistant

Paste this into Claude, ChatGPT, or any agent that can run the AWS CLI with read-only credentials. It audits your account for exactly the waste this sheet describes — and changes nothing.

You are auditing an AWS account for unutilized/over-provisioned NAT
Gateways. Use the AWS CLI with READ-ONLY credentials. Do not create,
modify, or delete anything — report findings and recommended (unapplied)
fixes only.

1. Inventory: aws ec2 describe-nat-gateways — id, VPC, AZ, associated EIP.
   For each, pull CloudWatch AWS/NATGateway BytesOutToDestination /
   ActiveConnectionCount over 30 days. Flag near-zero (unutilized).
2. VPC liveness: for each flagged NAT's VPC, check for live resources
   needing egress (ec2 describe-instances, VPC-attached lambda, ecs
   tasks, rds). Empty VPC => NAT has no caller (safe to delete).
3. Over-provisioning: flag multi-AZ NAT in dev/staging (single-AZ is
   fine) and NAT in AZs the workload doesn't deploy to.
4. Endpoint opportunity: from VPC Flow Logs on the NAT ENI, classify
   egress destinations. Mostly AWS services (S3/DynamoDB/ECR/CloudWatch/
   SSM) => recommend gateway endpoints (free, S3+DynamoDB) + interface
   endpoints to cut or eliminate NAT.

Report a table: NAT | VPC | AZ | 30-day bytes | live callers? | action
(delete+release EIP / drop to 1-AZ / replace with endpoints) | est. $/mo.
Note route-table cleanup + EIP release. Change nothing.
Works with any assistant that can run shell commands.

Want the guided version?

The Trusted Advisor — Unutilized NAT Gateways walkthrough covers this topic interactively — it asks about your setup, branches to what’s relevant, and quizzes you on the tricky parts. Free and anonymous.

Start the walkthrough

More Cost Governance cheat sheets

AWS Billing Conductor

Billing Conductor restructures how a bill is allocated and presented internally — pro-forma invoices with custom rates, markups, and line items — without changing what AWS actually charges. It's an accounting tool for MSPs and complex chargeback, not a savings tool.

AWS Budget Actions

A regular budget emails you; a Budget Action does the thing for you — attach a deny-IAM policy, apply an SCP, or stop tagged EC2/RDS when a threshold breaks. The difference between an alarm and a circuit breaker, and it costs nothing extra.

AWS Budgets

The one cost-governance feature to set up first: a threshold plus a notification that pings you before the bill lands. Forecasted-80% is the single most effective alert AWS offers; first two budgets are free.

AWS Cost and Usage Reports

Cost Explorer is a dashboard; CUR is the database. Every billing line item — one resource × one hour × one usage type, hundreds of columns — dumped to S3 for Athena/QuickSight when the question doesn't fit Cost Explorer's dropdowns. Use CUR 2.0 via Data Exports.