CostLensIdle Cloud NAT (GCP)

Idle Cloud NAT (GCP)

CostLens finds Cloud NAT gateways configured to NAT a subnetwork list but with no subnetworks selected — billing the gateway hourly rate while routing nothing.

Updated July 20261 min read

CostLens finds idle Cloud NAT gateways — NAT configs set to NAT a list of subnetworks but with no subnetworks selected. The gateway does no work yet bills the Cloud NAT hourly rate, a common leftover after the subnetworks it served were removed.

How it works

Cloud Routers are enumerated

CostLens lists Cloud Routers across regions via the Compute aggregated API and inspects each router's NAT configurations.

Empty NATs are flagged

A NAT with sourceSubnetworkIpRangesToNat = LIST_OF_SUBNETWORKS and an empty subnetworks list routes nothing — it's surfaced, priced at the Cloud NAT gateway hourly rate.

What to do

  1. Confirm no subnetworks are about to be attached to this NAT.
  2. Either attach the subnetworks it should serve, or delete the NAT configuration from the Cloud Router to stop the charge.

Severity levels

SeverityEstimated monthly savings
critical>$500
high$100–$500
medium$20–$100
low<$20

Required permissions

  • Detect: Compute read (roles/compute.viewer or the read scope) — see GCP Accounts.

Limitations

  • This is a config-only signal — it catches NATs that serve no subnetworks. A NAT that is attached to subnetworks but carries little traffic needs a metrics-based check (a planned fast-follow) and is not flagged here.
  • The estimate covers the gateway hourly rate; data-processing charges are billed separately.
CostLens
Previous
Bucket Version Cleanup
CostLens
Next
Idle Cloud SQL Instance