DEV Community: Krembo Vitman

How to Find AWS NAT Gateway Waste

Krembo Vitman — Tue, 04 Aug 2026 20:38:54 +0000

NAT gateways can become one of the most expensive "forgotten" AWS resources.
They charge hourly, and they also charge for data processing.

This guide shows how to find NAT gateways that deserve review.

Why NAT Gateways Are Expensive

A NAT gateway may be needed for private subnets to reach the internet. But old
test environments, retired VPCs, and low-traffic workloads often leave NAT
gateways running long after they are useful.

Even a single NAT gateway can cost meaningful money every month before data
processing charges.

List NAT Gateways

Run this in one region:

aws ec2 describe-nat-gateways \
  --region us-east-1 \
  --filter Name=state,Values=available \
  --query 'NatGateways[].{NatGatewayId:NatGatewayId,VpcId:VpcId,SubnetId:SubnetId,State:State}' \
  --output table

With a profile:

aws ec2 describe-nat-gateways \
  --profile production \
  --region us-east-1 \
  --filter Name=state,Values=available \
  --query 'NatGateways[].{NatGatewayId:NatGatewayId,VpcId:VpcId,SubnetId:SubnetId,State:State}' \
  --output table

Check All Regions

for region in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  echo "Region: $region"
  aws ec2 describe-nat-gateways \
    --region "$region" \
    --filter Name=state,Values=available \
    --query 'NatGateways[].{NatGatewayId:NatGatewayId,VpcId:VpcId,SubnetId:SubnetId,State:State}' \
    --output table
done

Check Route Table Usage

Before considering cleanup, inspect routes that point to the NAT gateway:

aws ec2 describe-route-tables \
  --region us-east-1 \
  --filters Name=route.nat-gateway-id,Values=nat-0123456789abcdef0 \
  --query 'RouteTables[].{RouteTableId:RouteTableId,VpcId:VpcId,Routes:Routes}' \
  --output json

If route tables still point 0.0.0.0/0 at the NAT gateway, deleting it can
break internet access from private subnets.

Check Traffic

Use CloudWatch metrics before making any decision. Look at bytes in/out and
packet drops over a meaningful window, such as 14 or 30 days.

Low traffic does not always mean unused, but it tells you where to investigate.

Safe Cleanup Order

If you confirm a NAT gateway is unnecessary:

Update or remove route table references.
Verify no route table points at the NAT gateway.
Delete the NAT gateway.
Wait for deletion to finish.
Decide separately whether to release the Elastic IP.

The Elastic IP may have separate external dependencies.

Easier Option

AWS Waste Finder flags running NAT gateways and puts them at the top of the
report because they have high cost potential.

Free repo:
https://github.com/byanivb/aws-waste-finder

Paid starter bundle:
https://basilian1.gumroad.com/l/aws-waste-finder

How to Find Old EBS Snapshots Costing Money in AWS

Krembo Vitman — Tue, 04 Aug 2026 20:32:29 +0000

Old EBS snapshots are a common AWS storage leak. A snapshot may only cost a few
dollars per month, but stale snapshots across regions and accounts can quietly
pile up.

This guide shows how to find old snapshots safely.

Why Old Snapshots Matter

EBS snapshots are incremental, but they still store changed blocks. Keeping old
snapshots forever can create long-term storage cost, especially when snapshots
come from retired instances, old migrations, or abandoned backup jobs.

AWS CLI Command

List snapshots owned by your account:

aws ec2 describe-snapshots \
  --owner-ids self \
  --region us-east-1 \
  --query 'Snapshots[].{SnapshotId:SnapshotId,StartTime:StartTime,VolumeSize:VolumeSize,Description:Description}' \
  --output table

Find Snapshots Older Than 90 Days

You can use jq for a more precise local filter:

cutoff=$(date -u -v-90d '+%Y-%m-%dT%H:%M:%S')

aws ec2 describe-snapshots \
  --owner-ids self \
  --region us-east-1 \
  --output json |
jq -r --arg cutoff "$cutoff" '
  .Snapshots[]
  | select(.StartTime < $cutoff)
  | [.SnapshotId, .StartTime, .VolumeSize, .Description]
  | @tsv
'

On Linux, replace the date command with:

cutoff=$(date -u -d '90 days ago' '+%Y-%m-%dT%H:%M:%S')

Check All Regions

Snapshots are regional:

for region in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  echo "Region: $region"
  aws ec2 describe-snapshots \
    --owner-ids self \
    --region "$region" \
    --query 'Snapshots[].{SnapshotId:SnapshotId,StartTime:StartTime,VolumeSize:VolumeSize}' \
    --output table
done

Before You Delete a Snapshot

Do not delete old snapshots blindly.

Check:

whether the snapshot backs an AMI
retention policies
compliance or audit requirements
disaster recovery plans
whether it was created before a risky migration or upgrade

If a snapshot backs an AMI, deregistering or deleting things in the wrong order
can break restore workflows.

Easier Option

AWS Waste Finder finds owned EBS snapshots older than your configured threshold
and estimates the monthly snapshot storage cost.

Free repo:
https://github.com/byanivb/aws-waste-finder

Paid starter bundle:
https://basilian1.gumroad.com/l/aws-waste-finder

How to Find Unused Elastic IPs in AWS

Krembo Vitman — Tue, 04 Aug 2026 20:31:56 +0000

Unused Elastic IPs are one of the easiest AWS cost leaks to miss. They look
small, but they keep billing while they are allocated and not attached to a
running resource.

This guide shows how to find them safely.

What Is an Unused Elastic IP?

An Elastic IP is likely unused when it has no AssociationId.

That means AWS has allocated the public IP to your account, but it is not
currently associated with an EC2 instance, NAT gateway, network interface, or
other resource.

AWS CLI Command

Run this for one region:

aws ec2 describe-addresses \
  --region us-east-1 \
  --query 'Addresses[?AssociationId==null].[AllocationId,PublicIp]' \
  --output table

Run it with a profile:

aws ec2 describe-addresses \
  --profile production \
  --region us-east-1 \
  --query 'Addresses[?AssociationId==null].[AllocationId,PublicIp]' \
  --output table

Check All Regions

Elastic IPs are regional, so check every enabled region:

for region in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  echo "Region: $region"
  aws ec2 describe-addresses \
    --region "$region" \
    --query 'Addresses[?AssociationId==null].[AllocationId,PublicIp]' \
    --output table
done

Before You Release an Elastic IP

Do not release an IP just because it is unattached.

First check:

DNS records
customer allowlists
partner allowlists
firewall rules
webhook documentation
old deployment or rollback notes

Some public IPs are referenced outside AWS, so AWS cannot tell you every
dependency.

Easier Option

AWS Waste Finder scans for unassociated Elastic IPs and includes them in a
Markdown, JSON, or HTML report.

Free repo:
https://github.com/byanivb/aws-waste-finder

Paid starter bundle:
https://basilian1.gumroad.com/l/aws-waste-finder