Low-Traffic NAT Gateway
CostLens detects NAT Gateways with minimal data transfer where the fixed hourly cost is disproportionate to actual usage.
A NAT Gateway costs $0.045 per hour (~$32.85/month) regardless of traffic, plus additional data transfer charges. For VPCs where the NAT Gateway carries very little traffic, this fixed cost is rarely worth it. CostLens flags NAT Gateways averaging less than 1 GB/day of outbound traffic and recommends replacing them with VPC endpoints, which are free or significantly cheaper for common AWS service traffic.
Deleting a NAT Gateway will break outbound internet access
If your subnets rely on this NAT Gateway for outbound internet access — even for a single resource — deleting it will immediately cut off that access. Carefully audit all resources in the associated subnets before applying this fix.
How it works
CostLens lists all NAT Gateways
Calls ec2:DescribeNatGateways to find all NAT Gateways in the available state.
Measures 7-day average traffic
Queries CloudWatch BytesOutToDestination for each NAT Gateway over the past 7 days.
Flags low-traffic gateways
NAT Gateways averaging less than 1 GB/day outbound are flagged as candidates for replacement.
Estimates savings
Calculates potential savings from eliminating the $32.85/month fixed charge, plus any data transfer savings if traffic can be rerouted through VPC endpoints.
What to do
Option 1 — Replace with VPC endpoints (recommended)
If the traffic through the NAT Gateway is primarily to AWS services (S3, DynamoDB, SSM, ECR, etc.), create free Gateway VPC endpoints or low-cost Interface VPC endpoints for those services. This eliminates the need for the NAT Gateway entirely for that traffic.
- Identify what services the traffic is going to (check VPC Flow Logs).
- Create a Gateway VPC endpoint for S3 and DynamoDB (free).
- For other AWS services, create Interface VPC endpoints (~$7–$10/month each, cheaper than a NAT Gateway for low volumes).
- Update your route tables to use the endpoints.
- Confirm traffic is flowing through the endpoints, then delete the NAT Gateway.
Option 2 — Delete the NAT Gateway if not needed
If no resources in the associated subnets require outbound internet access, delete the NAT Gateway and do not replace it.
Option 3 — Dismiss if traffic is legitimately low
If the NAT Gateway is intentionally provisioned for burst scenarios or for a low-traffic private environment, dismiss the recommendation.
Severity levels
| Severity | Estimated monthly savings |
|---|---|
| high | ~$32.85 (fixed per NAT Gateway) |
Most low-traffic NAT Gateway findings are classified as high severity due to the fixed $32.85/month cost.
Required IAM permissions
Included in the CostLens IAM policies from AWS Accounts:
ec2:DescribeNatGateways
cloudwatch:GetMetricStatistics
ec2:DeleteNatGateway
ec2:CreateVpcEndpoint