NAT Gateway: The Bill Nobody Reads

Group your AWS bill by service in Cost Explorer and NAT Gateway charges don't get their own row. They're folded into Amazon Virtual Private Cloud, sitting next to VPN connections, Transit Gateway attachments, and PrivateLink endpoints. Unless you break the view down by usage type — NatGateway-Hours, NatGateway-Bytes — the number you're actually paying for a gateway that might be doing nothing is invisible.

We wrote up the mechanics of that bill back in March — the $0.045/hour base charge, the $0.045/GB data processing fee, the multi-AZ multiplication that turns one gateway into three. That post is still accurate and worth reading if you want the full pricing breakdown. This one is about something different: what CloudWise's detector actually checks before it tells you a NAT Gateway is dead weight, and where that check still falls short.

What the detector actually looks at

The idle-NAT-gateway check lives in cloudwise_scan_core's network detector, alongside the unattached-EIP and idle-load-balancer checks — it's one pass over a VPC's network resources, not a dedicated NAT scanner. For every NAT Gateway in available state, it pulls two CloudWatch metrics over a 7-day window: ActiveConnectionCount and BytesOutToDestination. If both are zero for the full week, it flags the gateway as IDLE_NAT_GATEWAY at HIGH confidence.

Two design choices worth calling out:

Why 7 days, not 1. A single quiet day doesn't mean a gateway is unused — it might serve a batch job that runs Sundays, or a staging environment nobody touches on weekends. A full week with zero connections and zero bytes is a much harder signal to explain away.

Why the estimate is conservative. The finding's monthly_savings uses a flat $32.40 — the hourly base charge times a 720-hour month, not the $32.85 you'd get from AWS's actual 730-hour average. It also doesn't add anything for data processing, because by definition a gateway that's flagged idle processed zero bytes in the lookback window. The number CloudWise shows you is the floor, not an estimate padded to look impressive.

The finding's risk field is blunt about the tradeoff, too: deleting a NAT Gateway immediately cuts internet egress for every private-subnet resource routed through it. The action is offered — aws ec2 delete-nat-gateway — but nothing executes it without a human approving first. That's the same read-only-first posture behind every detector we ship, not something special-cased for NAT Gateways.

What it doesn't do yet

Here's the honest gap: the detector tells you a NAT Gateway earned its keep for zero dollars this week. It doesn't tell you what to replace it with.

That decision genuinely depends on what's routing through it:

• If the only traffic is S3 or DynamoDB, a Gateway VPC Endpoint replaces it for free — no hourly charge, no per-GB fee, ever.
• If it's other AWS services (Secrets Manager, ECR, CloudWatch Logs), an Interface VPC Endpoint runs $0.01/hour per AZ plus $0.01/GB — about 78% cheaper per gigabyte than NAT, though you're paying a small hourly fee per endpoint per AZ instead of one gateway.
• If it's a non-production environment with real internet egress needs but low traffic and no requirement for managed HA, a self-managed NAT instance (something like a t4g.nano) can run for a few dollars a month — you trade the 24/7 base charge for patching it yourself.

CloudWise doesn't make that call for you today. It's a fair next detector to build — matching an idle gateway's actual destination traffic against what a Gateway Endpoint could cover for free — but until it exists, the decision after "this is idle" is still on you. We'd rather say that plainly than imply the tool does more than it does.

Finding yours

If you want to see this in your own account without reading CloudWatch dashboards by hand, a free scan checks this along with 190+ other waste patterns across 40+ AWS services — read-only, five minutes, nothing gets deleted without you clicking it. We posted a 30-second walkthrough of this exact detector if you'd rather watch than read.

Or just run the two-metric check yourself:

aws cloudwatch get-metric-statistics \
  --namespace AWS/NATGateway \
  --metric-name BytesOutToDestination \
  --dimensions Name=NatGatewayId,Value=nat-0abc123def456 \
  --start-time $(date -u -v-7d +%Y-%m-%dT%H:%M:%S) \
  --end-time $(date -u +%Y-%m-%dT%H:%M:%S) \
  --period 86400 \
  --statistics Sum

Seven zeros in a row is $32.40 a month for a gateway that isn't gating anything.