While auditing cloud infrastructure costs this week, recurring configuration gaps continue to quietly inflate monthly bills.

Field Insight: The Hidden Cost Trap

Each NAT Gateway bills a fixed $0.045/hour ($32.85/month base) before moving a single packet, plus $0.045/GB data processing and a $0.01/GB cross-AZ inter-subnet penalty when traffic routes to a NAT Gateway in another Availability Zone. Orphaned NAT Gateways in forgotten VPCs burn about $395/year each in baseline fees, and for high-throughput services hitting S3 or DynamoDB through NAT, replacing NAT processing with free Gateway VPC Endpoints saves $45 per terabyte processed.

Automated Detection: Auditing Idle NAT Gateways with Boto3 

import boto3 from datetime import datetime, timedelta, timezone def audit_idle_nat_gateways(region='us-east-1'): ec2 = boto3.client('ec2', region_name=region) cw = boto3.client('cloudwatch', region_name=region) now = datetime.now(timezone.utc) seven_days_ago = now - timedelta(days=7) nats = ec2.describe_nat_gateways( Filters=[{'Name': 'state', 'Values': ['available']}] ).get('NatGateways', []) idle_nats = [] for nat in nats: res = cw.get_metric_statistics( Namespace='AWS/NATGateway', MetricName='BytesOutFromDestination', Dimensions=[{'Name': 'NatGatewayId', 'Value': nat['NatGatewayId']}], StartTime=seven_days_ago, EndTime=now, Period=604800, Statistics=['Sum'] ) datapoints = res.get('Datapoints', []) total_bytes = datapoints[0]['Sum'] if datapoints else 0 if total_bytes < 1_000_000: # under 1 MB in 7 days idle_nats.append(nat['NatGatewayId']) print(f"[ALERT] {nat['NatGatewayId']} moved {total_bytes:.0f} bytes in 7 days; " f"base cost alone is $32.85/mo ($0.045/hr).") print(f"[{region}] Idle NAT Gateways: {len(idle_nats)} of {len(nats)}") return idle_nats if __name__ == '__main__': audit_idle_nat_gateways()

Running ad-hoc scripts in a single account or region does not scale across enterprise AWS Organizations. Sustained cloud cost governance requires automated anomaly detection, cross-account STS role assumption, and scheduled auditing.

  • 📦 Download Free Single-Account Core: Free Lite Package | GitHub
  • 💼 Managing Multiple Accounts or Client Infrastructure?
    • Practitioner License ($99): Single-account CLI scanner, compliance exports, and dynamic bash remediation.
    • Consultancy & Agency Pack ($499): Automated multi-account STS role assumption, CloudFormation StackSets, and branded executive PDF showback reports.

👉 Get the AWS Cloud Cost Auditor on Gumroad