Explanation
Why the waste happens and who it affects.
In many environments, NAT configurations are created for temporary access (e.g., one-off updates, patching windows, or ephemeral resources) and are never cleaned up. If no traffic is flowing, these NAT gateways remain idle yet continue to generate charges for their NAT IP addresses and for any VM instances still assigned to the gateway. This is especially common in non-production environments or when legacy configurations are forgotten.
Billing model
The pricing dimensions that drive this cost.
Billed based on:
- Number of NAT IP addresses used per hour
- Number of VM instances using the gateway per hour (the hourly gateway rate is capped at 32 VM instances)
- Gigabytes of data processed by the gateway, both inbound and outbound. An idle gateway incurs no data processing charges, but it still bills hourly for each NAT IP address it uses and for any VM instances that still have a NAT assignment.
How to detect
4 checks to find it in your estate.
- Identify Cloud NAT gateways with active configurations but no recent egress traffic
- Cross-reference NAT configurations with active VM instances or workloads that require external access
- Evaluate whether any static IPs are still reserved for inactive NATs
- Review staging, test, or decommissioned environments where NATs may remain unintentionally
How to fix
4 ways to remove the waste.
- Decommission unused Cloud NAT gateways with no associated traffic
- Release reserved external IP addresses if no longer needed
- Consolidate NAT configurations where feasible across shared VPCs or regions
- Implement tagging and lifecycle policies for temporary NAT configurations to ensure cleanup
Documentation
Vendor references for pricing and configuration.