AWS Idle NAT Gateway Detector
Identify provisioned Amazon VPC NAT Gateways with near-zero throughput draining hourly egress fees 24/7.
1. Detection Scope & Operational Boundaries
Every ArthaOps detector enforces strict epistemic honesty. We clearly separate what can be mathematically proven via agentless telemetry from what requires contextual human judgement.
What This Detector Identifies
- Provisioned NAT Gateways in available state processing < 1 MB of traffic per day over a rolling 14-day observation window.
- NAT Gateways with ActiveConnectionCount metric consistently below 5 concurrent flows.
- Redundant secondary availability-zone NAT Gateways where associated subnets host zero running EC2 or container workloads.
What It Cannot Establish Alone
- Whether the NAT Gateway serves as a mandatory dormant disaster recovery route for secondary failover VPCs.
- Whether external partner firewall policies mandate an egress route through the specific Elastic IP attached to this gateway.
- Whether intermittent monthly batch jobs (such as quarterly compliance audit dumps) require outbound access on future dates.
2. Telemetry & Evidence Requirements
ArthaOps operates strictly via Plane 1 (Read-Only Discovery). The following CloudFormation / IAM permissions and CloudWatch metrics are evaluated:
AWS::EC2::NatGatewayVerification Protocol: Tested against synthetic VPC fixtures verifying zero BytesOutToDestination and ActiveConnectionCount < 5 across rolling 14-day windows.
Validation Context: Validated in high-scale logistics and e-commerce AWS Mumbai accounts (e.g. Rebel Foods & OneCard scale workloads).
3. Reproducible AWS CLI Verification Recipe
Run this non-destructive query using read-only AWS CLI credentials to identify active NAT Gateways and evaluate 14-day egress volume.
# 1. List all available NAT Gateways in ap-south-1
aws ec2 describe-nat-gateways \
--region ap-south-1 \
--filter "Name=state,Values=available" \
--query "NatGateways[*].{NatGatewayId:NatGatewayId,VpcId:VpcId,SubnetId:SubnetId,State:State,CreateTime:CreateTime}" \
--output table
# 2. Check 14-day outbound byte throughput for target gateway
aws cloudwatch get-metric-statistics \
--region ap-south-1 \
--namespace AWS/NATGateway \
--metric-name BytesOutToDestination \
--dimensions Name=NatGatewayId,Value=nat-0a1b2c3d4e5f67890 \
--start-time $(date -u -v-14d +%Y-%m-%dT%H:%M:%SZ) \
--end-time $(date -u +%Y-%m-%dT%H:%M:%SZ) \
--period 86400 \
--statistics Sum \
--query "Datapoints[*].{Date:Timestamp,BytesOut:Sum}" \
--output table--------------------------------------------------------------------------------------
| DescribeNatGateways |
+----------------------+--------------------------+-----------------------+----------+
| CreateTime | NatGatewayId | SubnetId | VpcId |
+----------------------+--------------------------+-----------------------+----------+
| 2026-06-14T08:12:00Z | nat-0a1b2c3d4e5f67890 | subnet-0123456789abc | vpc-prod |
+----------------------+--------------------------+-----------------------+----------+💡 If daily BytesOut sums are consistently 0 or < 1,048,576 bytes (1 MB) while state remains available, the gateway is actively accruing unrecoverable hourly charges with negligible utility.
4. Transparent Economic Model
- 730 operational hours per standard calendar month.
- Static conversion rate of ₹84.00 per USD minor-unit equivalent.
- Zero data processing charge included (evaluated purely on base provisioned hourly commitment).
- Data processing charges ($0.056/GB processed in Mumbai) are excluded as idle gateways transmit negligible data.
- Associated Elastic IP base costs ($0.005/hr) are tracked independently under IPv4 scarcity.
5. False-Positive Scenarios & Operational Risks
Never delete or terminate cloud resources blindly. These validated architectural scenarios must be reviewed before initiating remediation:
Documented False-Positive Scenarios
- Multi-AZ High Availability Redundancy: Primary workloads run in ap-south-1a while a standby NAT Gateway sits in ap-south-1b for automated failover. Deleting the standby NAT breaks automated AZ failover.
- VPC Peering Routing: Private subnets in another peered VPC may route egress through this gateway despite local subnets hosting no instances.
- Scheduled Batch Egress: Monthly payroll, tax reporting, or off-site disaster recovery scripts that run exclusively on calendar end-of-month.
Blast Radius & Remediation Risks
- Immediate Egress Severance: Deleting a NAT Gateway without updating the subnet route table causes immediate 100% outbound packet drop for all private EC2 instances, EKS pods, and Lambda functions in that subnet.
- Elastic IP Disassociation: Deleting the gateway disassociates its attached Elastic IP. If the EIP is not explicitly released, it will silently transition to unassociated status and continue billing at $0.005/hr.
6. Remediation Procedure & Rollback Runbook
Follow this ordered sequence of verified AWS CLI actions to remediate the resource with complete rollback availability:
Inspect Subnet Route Tables
Identify every route table referencing the NAT Gateway as a target for 0.0.0.0/0.
aws ec2 describe-route-tables --filters "Name=route.nat-gateway-id,Values=nat-0a1b2c3d4e5f67890" --output tableDeploy Free VPC Gateway Endpoints
If traffic was intended for S3 or DynamoDB, provision AWS VPC Gateway Endpoints (which carry $0.00 data and hourly charges) to keep AWS API traffic inside the VPC.
aws ec2 create-vpc-endpoint --vpc-id vpc-01234567 --service-name com.amazonaws.ap-south-1.s3 --route-table-ids rtb-01234567Reroute Subnet Default Route
Update the route table to direct 0.0.0.0/0 to an active NAT Gateway in an adjacent availability zone, or delete the default route if egress is not required.
aws ec2 replace-route --route-table-id rtb-01234567 --destination-cidr-block 0.0.0.0/0 --nat-gateway-id nat-active-primaryDelete the Idle NAT Gateway
Delete the gateway once zero active routes target it. Gateway state transitions to deleting.
aws ec2 delete-nat-gateway --nat-gateway-id nat-0a1b2c3d4e5f67890Release the Associated Elastic IP
Once the gateway transitions to deleted, release the allocated Elastic IP to avoid incurring $0.005/hr unassociated IP charges.
aws ec2 release-address --allocation-id eipalloc-0123456789abcdef0Forensic Rollback Procedure
If outbound connectivity drops, execute `aws ec2 create-nat-gateway --subnet-id <subnet> --allocation-id <eip>` and re-point the route table destination `0.0.0.0/0` to the newly provisioned gateway ID. Provisioning typically completes in 60–120 seconds.
🔒 ArthaOps Assurance: ArthaOps executes remediation strictly through Plane 2 Human-Approved CloudFormation mutations with pre-flight routing validation, never mutating default route tables without explicit approval.
Deleting a NAT Gateway cannot be rolled back in-place; re-creating a gateway generates a new NatGatewayId (`nat-xxxx`), mandating route table updates to direct traffic to the new identifier.
How This Appears in the ArthaOps Control Plane
NAT Gateway active in ap-south-1b staging subnet with 0 bytes transmitted across 14 consecutive days.
Test Your Infrastructure in 180 Seconds
Explore our zero-setup interactive sample report covering real Mumbai findings, or launch a 100% read-only agentless scan across your AWS environment.