Idle NAT Gateway (Azure)
CostLens finds Azure NAT gateways not associated with any subnet — billing the base resource-hour rate while routing no traffic.
CostLens finds idle Azure NAT gateways — gateways not associated with any subnet. A NAT gateway attached to nothing still bills the base resource-hour rate while routing zero traffic, a common leftover after a subnet or workload is removed.
Deletion is irreversible
Deleting a NAT gateway removes its configuration. CostLens shows this as an irreversible fix and cannot roll it back. Re-create it later if a subnet needs outbound NAT again.
How it works
NAT gateways are enumerated
CostLens lists NAT gateways via the Azure Resource Manager API and inspects each gateway's subnets associations.
Idle gateways are flagged
Gateways associated with no subnet are surfaced, priced at the NAT gateway base resource-hour rate.
What to do
- Confirm the gateway isn't a placeholder for an imminent subnet attachment.
- Delete it to stop the charge — via CostLens Apply Fix (irreversible) once write access is granted, or in the Azure portal.
Severity levels
| Severity | Estimated monthly savings |
|---|---|
| critical | >$500 |
| high | $100–$500 |
| medium | $20–$100 |
| low | <$20 |
Required permissions
- Detect:
Reader— see Azure Accounts. - Apply Fix (delete): a write role with
Microsoft.Network/natGateways/delete.
Limitations
- Only gateways with no subnet association are flagged. A gateway attached to a subnet but carrying no traffic is not surfaced here (a metrics-based idle check is a planned fast-follow).
- The estimate covers the base resource-hour rate; data-processing charges are billed separately.