an idle NAT Gateway still costs about $32 a month

"""Find NAT Gateways with no traffic and report what they cost.

A NAT Gateway bills per hour it exists, so an idle one is pure waste. But quiet is
not the same as unused -- a monthly batch job looks idle for 29 days -- so this
reports by default and deletes only a gateway you name explicitly.
"""
import argparse
import datetime as dt
import logging
import sys

import boto3

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("nat_gateway_idle_audit")

# us-east-1 list price, August 2026. Other regions differ; see the sources.
HOURLY_USD = 0.045
MONTHLY_USD = HOURLY_USD * 24 * 30


def egress_bytes(cw, nat_id, days):
    """Total bytes out to the internet over the window."""
    end = dt.datetime.now(dt.timezone.utc)
    points = cw.get_metric_statistics(
        Namespace="AWS/NATGateway",
        MetricName="BytesOutToDestination",
        Dimensions=[{"Name": "NatGatewayId", "Value": nat_id}],
        StartTime=end - dt.timedelta(days=days),
        EndTime=end,
        Period=86400,
        Statistics=["Sum"],
    )["Datapoints"]
    return sum(p["Sum"] for p in points)


def verdict(total_bytes, days, threshold_bytes=1_000_000):
    """Pure decision function.

    A threshold rather than zero, because health checks and DNS produce a trickle
    on a gateway nothing actually uses. A megabyte over two weeks is noise.
    """
    if total_bytes <= threshold_bytes:
        return "IDLE", f"{total_bytes:,.0f} bytes in {days} days"
    return "IN USE", f"{total_bytes / 1e9:.2f} GB in {days} days"


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("--region", default="us-east-1")
    ap.add_argument("--days", type=int, default=14)
    ap.add_argument("--delete", help="NAT Gateway id to delete")
    ap.add_argument("--apply", action="store_true")
    args = ap.parse_args()

    ec2 = boto3.client("ec2", region_name=args.region)
    cw = boto3.client("cloudwatch", region_name=args.region)

    gws = ec2.describe_nat_gateways(
        Filter=[{"Name": "state", "Values": ["available"]}])["NatGateways"]
    if not gws:
        log.info("no available NAT Gateways in %s", args.region)
        return 0

    idle_cost = 0.0
    for gw in gws:
        nat_id = gw["NatGatewayId"]
        state, detail = verdict(egress_bytes(cw, nat_id, args.days), args.days)
        line = f"{nat_id} in {gw['VpcId']} -- {detail}, ~${MONTHLY_USD:.2f}/month"
        if state == "IDLE":
            idle_cost += MONTHLY_USD
            log.warning("IDLE   %s", line)
        else:
            log.info("IN USE %s", line)

    if idle_cost:
        log.warning("idle NAT Gateways are costing about $%.2f/month", idle_cost)
        log.warning("check route tables before deleting: "
                    "aws ec2 describe-route-tables --filters "
                    "Name=route.nat-gateway-id,Values=<id>")

    if args.delete:
        if args.apply:
            ec2.delete_nat_gateway(NatGatewayId=args.delete)
            log.info("deleting %s", args.delete)
        else:
            log.info("WOULD delete %s -- pass --apply", args.delete)
    return 0


if __name__ == "__main__":
    sys.exit(main())

/**
 * Find NAT Gateways with no traffic and report what they cost.
 *
 * A NAT Gateway bills per hour it exists, so an idle one is pure waste. But quiet
 * is not the same as unused -- a monthly batch job looks idle for 29 days -- so
 * this reports by default and deletes only a gateway you name explicitly.
 */
import { EC2Client, DescribeNatGatewaysCommand, DeleteNatGatewayCommand } from '@aws-sdk/client-ec2';
import { CloudWatchClient, GetMetricStatisticsCommand } from '@aws-sdk/client-cloudwatch';

// us-east-1 list price, August 2026. Other regions differ; see the sources.
const HOURLY_USD = 0.045;
const MONTHLY_USD = HOURLY_USD * 24 * 30;

async function egressBytes(cw, natId, days) {
  const EndTime = new Date();
  const StartTime = new Date(EndTime.getTime() - days * 86400_000);
  const out = await cw.send(new GetMetricStatisticsCommand({
    Namespace: 'AWS/NATGateway',
    MetricName: 'BytesOutToDestination',
    Dimensions: [{ Name: 'NatGatewayId', Value: natId }],
    StartTime, EndTime, Period: 86400, Statistics: ['Sum'],
  }));
  return (out.Datapoints ?? []).reduce((t, p) => t + (p.Sum ?? 0), 0);
}

/**
 * Pure decision function.
 *
 * A threshold rather than zero, because health checks and DNS produce a trickle on
 * a gateway nothing actually uses. A megabyte over two weeks is noise.
 */
export function verdict(totalBytes, days, thresholdBytes = 1_000_000) {
  if (totalBytes <= thresholdBytes) {
    return { state: 'IDLE', detail: `${totalBytes.toLocaleString()} bytes in ${days} days` };
  }
  return { state: 'IN USE', detail: `${(totalBytes / 1e9).toFixed(2)} GB in ${days} days` };
}

async function main() {
  const region = process.env.AWS_REGION ?? 'us-east-1';
  const days = Number(process.env.DAYS ?? 14);
  const apply = process.argv.includes('--apply');
  const toDelete = process.argv[process.argv.indexOf('--delete') + 1];

  const ec2 = new EC2Client({ region });
  const cw = new CloudWatchClient({ region });

  const { NatGateways = [] } = await ec2.send(new DescribeNatGatewaysCommand({
    Filter: [{ Name: 'state', Values: ['available'] }],
  }));
  if (!NatGateways.length) return console.log(`no available NAT Gateways in ${region}`);

  let idleCost = 0;
  for (const gw of NatGateways) {
    const { state, detail } = verdict(await egressBytes(cw, gw.NatGatewayId, days), days);
    const line = `${gw.NatGatewayId} in ${gw.VpcId} -- ${detail}, ~$${MONTHLY_USD.toFixed(2)}/month`;
    if (state === 'IDLE') { idleCost += MONTHLY_USD; console.warn(`IDLE   ${line}`); }
    else console.log(`IN USE ${line}`);
  }
  if (idleCost) {
    console.warn(`idle NAT Gateways are costing about $${idleCost.toFixed(2)}/month`);
  }

  if (process.argv.includes('--delete')) {
    if (apply) {
      await ec2.send(new DeleteNatGatewayCommand({ NatGatewayId: toDelete }));
      console.log(`deleting ${toDelete}`);
    } else {
      console.log(`WOULD delete ${toDelete} -- pass --apply`);
    }
  }
}

if (import.meta.url === `file://${process.argv[1]}`) main();

from nat_gateway_idle_audit import verdict


def test_zero_traffic_is_idle():
    state, _ = verdict(0, 14)
    assert state == "IDLE"


def test_a_trickle_is_still_idle():
    """Health checks and DNS leak bytes through a gateway nothing really uses."""
    state, _ = verdict(500_000, 14)
    assert state == "IDLE"


def test_real_traffic_is_in_use():
    state, detail = verdict(5_000_000_000, 14)
    assert state == "IN USE"
    assert "GB" in detail


def test_the_threshold_boundary_is_inclusive():
    assert verdict(1_000_000, 14)[0] == "IDLE"
    assert verdict(1_000_001, 14)[0] == "IN USE"

import { test } from 'node:test';
import assert from 'node:assert/strict';
import { verdict } from './nat-gateway-idle-audit.mjs';

test('zero traffic is idle', () => {
  assert.equal(verdict(0, 14).state, 'IDLE');
});

test('a trickle is still idle', () => {
  assert.equal(verdict(500_000, 14).state, 'IDLE');
});

test('real traffic is in use', () => {
  const { state, detail } = verdict(5_000_000_000, 14);
  assert.equal(state, 'IN USE');
  assert.match(detail, /GB/);
});

test('the threshold boundary is inclusive', () => {
  assert.equal(verdict(1_000_000, 14).state, 'IDLE');
  assert.equal(verdict(1_000_001, 14).state, 'IN USE');
});