Find Idle NAT Gateways Costing You Money (AWS SDK v3)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadNatGatewaysRoutesAndMetrics",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeNatGateways",
        "ec2:DescribeRouteTables",
        "cloudwatch:GetMetricData"
      ],
      "Resource": "*"
    }
  ]
}

// find-idle-nat-gateways.ts
// Reports NAT gateways in one region that moved little or no traffic in the last --days days,
// with the route tables that point at them and their fixed monthly cost. Read-only.
// Usage: npx tsx find-idle-nat-gateways.ts [--days 14] [--max-gb 1]
import {
  EC2Client,
  paginateDescribeNatGateways,
  paginateDescribeRouteTables,
  type NatGateway,
} from "@aws-sdk/client-ec2";
import { CloudWatchClient, GetMetricDataCommand } from "@aws-sdk/client-cloudwatch";

// USD, us-east-1, as of September 2026. Regional NAT gateways bill this per Availability Zone.
const NAT_PER_HOUR = 0.045;
const NAT_PER_GB = 0.045;
const HOURS_PER_MONTH = 730;

function arg(name: string): string | undefined {
  const i = process.argv.indexOf(name);
  return i === -1 ? undefined : process.argv[i + 1];
}

const ec2 = new EC2Client({}); // region from AWS_REGION or your profile
const cw = new CloudWatchClient({});

// Zonal gateways publish metrics with NatGatewayId only; regional ones add AvailabilityZone.
// A SEARCH expression summed across zones works for both.
function search(nat: NatGateway, metric: string, stat: string, period: number): string {
  const schema = nat.AvailabilityMode === "regional" ? "{AWS/NATGateway,AvailabilityZone,NatGatewayId}" : "{AWS/NATGateway,NatGatewayId}";
  return `SUM(SEARCH('${schema} MetricName="${metric}" NatGatewayId="${nat.NatGatewayId}"', '${stat}', ${period}))`;
}

async function traffic(nat: NatGateway, days: number) {
  const end = new Date();
  const start = new Date(end.getTime() - days * 86_400_000);
  const period = 86_400; // one data point per day
  const res = await cw.send(
    new GetMetricDataCommand({
      StartTime: start,
      EndTime: end,
      MetricDataQueries: [
        { Id: "bytesout", Expression: search(nat, "BytesOutToDestination", "Sum", period), Period: period },
        { Id: "bytesin", Expression: search(nat, "BytesInFromDestination", "Sum", period), Period: period },
        { Id: "conns", Expression: search(nat, "ActiveConnectionCount", "Maximum", period), Period: period },
      ],
    }),
  );
  const values = (id: string) => res.MetricDataResults?.find((r) => r.Id === id)?.Values ?? [];
  const sum = (xs: number[]) => xs.reduce((s, x) => s + x, 0);
  return {
    gbOut: sum(values("bytesout")) / 1e9,
    gbIn: sum(values("bytesin")) / 1e9,
    maxConnections: Math.max(0, ...values("conns")),
  };
}

async function main(): Promise<void> {
  const days = Number(arg("--days") ?? 14);
  const maxGb = Number(arg("--max-gb") ?? 1);

  const nats: NatGateway[] = [];
  for await (const page of paginateDescribeNatGateways({ client: ec2 }, { Filter: [{ Name: "state", Values: ["available"] }] })) {
    nats.push(...(page.NatGateways ?? []));
  }
  if (nats.length === 0) {
    console.log("No available NAT gateways in this region.");
    return;
  }

  // Which route tables send traffic to each NAT gateway?
  const routes = new Map<string, string[]>();
  for await (const page of paginateDescribeRouteTables({ client: ec2 }, {})) {
    for (const rt of page.RouteTables ?? []) {
      for (const r of rt.Routes ?? []) {
        if (r.NatGatewayId) routes.set(r.NatGatewayId, [...(routes.get(r.NatGatewayId) ?? []), rt.RouteTableId ?? ""]);
      }
    }
  }

  const rows = [];
  let idleCost = 0;
  for (const nat of nats) {
    const id = nat.NatGatewayId ?? "";
    const t = await traffic(nat, days);
    const regional = nat.AvailabilityMode === "regional";
    const hourlyPerMonth = NAT_PER_HOUR * HOURS_PER_MONTH; // per AZ for a regional gateway
    const routeTables = routes.get(id) ?? [];
    const verdict =
      routeTables.length === 0 ? "IDLE: no route points here"
      : t.gbOut + t.gbIn === 0 && t.maxConnections === 0 ? "IDLE: no traffic"
      : t.gbOut + t.gbIn < maxGb ? "LOW traffic"
      : "in use";
    if (verdict !== "in use") idleCost += hourlyPerMonth;
    rows.push({
      "NAT gateway": id,
      Name: nat.Tags?.find((tag) => tag.Key === "Name")?.Value ?? "",
      Mode: regional ? "regional" : "zonal",
      Type: nat.ConnectivityType ?? "",
      VPC: nat.VpcId ?? "",
      "Route tables": routeTables.length,
      [`GB out (${days}d)`]: t.gbOut.toFixed(2),
      [`GB in (${days}d)`]: t.gbIn.toFixed(2),
      "Max conns": t.maxConnections,
      "Hourly $/mo": hourlyPerMonth.toFixed(2) + (regional ? " per AZ" : ""),
      [`Data $ (${days}d)`]: ((t.gbOut + t.gbIn) * NAT_PER_GB).toFixed(2),
      Verdict: verdict,
    });
  }
  console.table(rows);
  console.log(`Idle or low-traffic NAT gateways: at least $${idleCost.toFixed(2)}/month in hourly charges.`);
  console.log("Report only: nothing was changed. Confirm with the VPC owner before deleting a NAT gateway.");
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-ec2 @aws-sdk/client-cloudwatch
npm install --save-dev tsx typescript

# Default: last 14 days, "low" means under 1 GB
AWS_PROFILE=readonly AWS_REGION=us-east-1 npx tsx find-idle-nat-gateways.ts

# Look back 30 days and treat anything under 5 GB as low
AWS_PROFILE=readonly AWS_REGION=eu-west-1 npx tsx find-idle-nat-gateways.ts --days 30 --max-gb 5

┌─────────┬─────────────────────────┬───────────────┬─────────┬───────────┬─────────────────────────┬──────────────┬──────────────┬─────────────┬───────────┬─────────────┬──────────────┬──────────────────────────────┐
│ (index) │ NAT gateway             │ Name          │ Mode    │ Type      │ VPC                     │ Route tables │ GB out (14d) │ GB in (14d) │ Max conns │ Hourly $/mo │ Data $ (14d) │ Verdict                      │
├─────────┼─────────────────────────┼───────────────┼─────────┼───────────┼─────────────────────────┼──────────────┼──────────────┼─────────────┼───────────┼─────────────┼──────────────┼──────────────────────────────┤
│ 0       │ 'nat-0a1b2c3d4e5f60718' │ 'prod-nat-1a' │ 'zonal' │ 'public'  │ 'vpc-0123456789abcdef0' │ 2            │ '412.37'     │ '1893.04'   │ 1840      │ '32.85'     │ '103.74'     │ 'in use'                     │
│ 1       │ 'nat-0b2c3d4e5f6071829' │ 'staging-nat' │ 'zonal' │ 'public'  │ 'vpc-0fedcba9876543210' │ 1            │ '0.21'       │ '0.35'      │ 3         │ '32.85'     │ '0.03'       │ 'LOW traffic'                │
│ 2       │ 'nat-0c3d4e5f607182930' │ 'old-poc-nat' │ 'zonal' │ 'public'  │ 'vpc-0a9b8c7d6e5f40312' │ 0            │ '0.00'       │ '0.00'      │ 0         │ '32.85'     │ '0.00'       │ 'IDLE: no route points here' │
└─────────┴─────────────────────────┴───────────────┴─────────┴───────────┴─────────────────────────┴──────────────┴──────────────┴─────────────┴───────────┴─────────────┴──────────────┴──────────────────────────────┘
Idle or low-traffic NAT gateways: at least $65.70/month in hourly charges.
Report only: nothing was changed. Confirm with the VPC owner before deleting a NAT gateway.