DEV Community

Krembo Vitman
Krembo Vitman

Posted on

How to Find AWS NAT Gateway Waste

#devops #aws #cloud #tutorial

NAT gateways can become one of the most expensive "forgotten" AWS resources.
They charge hourly, and they also charge for data processing.

This guide shows how to find NAT gateways that deserve review.

Why NAT Gateways Are Expensive

A NAT gateway may be needed for private subnets to reach the internet. But old
test environments, retired VPCs, and low-traffic workloads often leave NAT
gateways running long after they are useful.

Even a single NAT gateway can cost meaningful money every month before data
processing charges.

List NAT Gateways

Run this in one region:

aws ec2 describe-nat-gateways \
  --region us-east-1 \
  --filter Name=state,Values=available \
  --query 'NatGateways[].{NatGatewayId:NatGatewayId,VpcId:VpcId,SubnetId:SubnetId,State:State}' \
  --output table
Enter fullscreen mode Exit fullscreen mode

With a profile:

aws ec2 describe-nat-gateways \
  --profile production \
  --region us-east-1 \
  --filter Name=state,Values=available \
  --query 'NatGateways[].{NatGatewayId:NatGatewayId,VpcId:VpcId,SubnetId:SubnetId,State:State}' \
  --output table
Enter fullscreen mode Exit fullscreen mode

Check All Regions 

for region in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  echo "Region: $region"
  aws ec2 describe-nat-gateways \
    --region "$region" \
    --filter Name=state,Values=available \
    --query 'NatGateways[].{NatGatewayId:NatGatewayId,VpcId:VpcId,SubnetId:SubnetId,State:State}' \
    --output table
done
Enter fullscreen mode Exit fullscreen mode

Check Route Table Usage

Before considering cleanup, inspect routes that point to the NAT gateway:

aws ec2 describe-route-tables \
  --region us-east-1 \
  --filters Name=route.nat-gateway-id,Values=nat-0123456789abcdef0 \
  --query 'RouteTables[].{RouteTableId:RouteTableId,VpcId:VpcId,Routes:Routes}' \
  --output json
Enter fullscreen mode Exit fullscreen mode

If route tables still point 0.0.0.0/0 at the NAT gateway, deleting it can
break internet access from private subnets.

Check Traffic

Use CloudWatch metrics before making any decision. Look at bytes in/out and
packet drops over a meaningful window, such as 14 or 30 days.

Low traffic does not always mean unused, but it tells you where to investigate.

Safe Cleanup Order

If you confirm a NAT gateway is unnecessary:

  1. Update or remove route table references.
  2. Verify no route table points at the NAT gateway.
  3. Delete the NAT gateway.
  4. Wait for deletion to finish.
  5. Decide separately whether to release the Elastic IP.

The Elastic IP may have separate external dependencies.

Easier Option

AWS Waste Finder flags running NAT gateways and puts them at the top of the
report because they have high cost potential.

Free repo:
https://github.com/byanivb/aws-waste-finder

Paid starter bundle:
https://basilian1.gumroad.com/l/aws-waste-finder

Top comments (0)