AWS FinOps Field Notes: Eliminating Idle NAT Gateways and Cross-AZ Traffic Traps

While auditing cloud infrastructure costs this week, recurring configuration gaps continue to quietly inflate monthly bills.

Field Insight: The Hidden Cost Trap

Each NAT Gateway bills a fixed $0.045/hour ($32.85/month base) before moving a single packet, plus $0.045/GB data processing and a $0.01/GB cross-AZ inter-subnet penalty when traffic routes to a NAT Gateway in another Availability Zone.

Orphaned NAT Gateways in forgotten VPCs burn about $395/year each in baseline fees, and for high-throughput services hitting S3 or DynamoDB through NAT, replacing NAT processing with free Gateway VPC Endpoints saves $45 per terabyte processed.

Automated Detection: Auditing Idle NAT Gateways with Boto3

import boto3
from datetime import datetime, timedelta, timezone

def audit_idle_nat_gateways(region='us-east-1'):
    ec2 = boto3.client('ec2', region_name=region)
    cw = boto3.client('cloudwatch', region_name=region)
    now = datetime.now(timezone.utc)
    seven_days_ago = now - timedelta(days=7)
    nats = ec2.describe_nat_gateways(
        Filters=[{'Name': 'state', 'Values': ['available']}]
    ).get('NatGateways', [])
    idle_nats = []
    for nat in nats:
        res = cw.get_metric_statistics(
            Namespace='AWS/NATGateway',
            MetricName='BytesOutFromDestination',
            Dimensions=[{'Name': 'NatGatewayId', 'Value': nat['NatGatewayId']}],
            StartTime=seven_days_ago,
            EndTime=now,
            Period=604800,
            Statistics=['Sum']
        )
        datapoints = res.get('Datapoints', [])
        total_bytes = datapoints[0]['Sum'] if datapoints else 0
        if total_bytes < 1_000_000: # under 1 MB in 7 days
            idle_nats.append(nat['NatGatewayId'])
            print(f"[ALERT] {nat['NatGatewayId']} moved {total_bytes:.0f} bytes in 7 days; "
                  f"base cost alone is $32.85/mo ($0.045/hr).")
    print(f"[{region}] Idle NAT Gateways: {len(idle_nats)} of {len(nats)}")
    return idle_nats

if __name__ == '__main__':
    audit_idle_nat_gateways()

Running ad-hoc scripts in a single account or region does not scale across enterprise AWS Organizations. Sustained cloud cost governance requires automated anomaly detection, cross-account STS role assumption, and scheduled auditing.

• 📦 Download Free Single-Account Core: Free Lite Package | GitHub
• 💼 Managing Multiple Accounts or Client Infrastructure?
• Practitioner License ($99): Single-account CLI scanner, compliance exports, and dynamic bash remediation.
• Consultancy & Agency Pack ($499): Automated multi-account STS role assumption, CloudFormation StackSets, and branded executive PDF showback reports.

👉 Get the AWS Cloud Cost Auditor on Gumroad