Free plan Signups are open now. The full audytx engine — Terraform and CloudFormation — is live. The Free plan is 100 scans a month and stays free — paid tiers arrive Nov 01, 2026 from $20/month for unlimited repositories. Try it on your own code.

NAT gateway incurs hourly and processing charges

AWS_OPS_048 LOW Cost

What it checks

NAT Gateway: this gateway bills hourly.

Where it applies

Terraform: aws_nat_gateway

CloudFormation: AWS::EC2::NatGateway

How to fix it

  1. Inventory the gateway's routes, VPC owner, public or private connectivity purpose and Availability Zone requirements. If workloads in several AZs share one NAT gateway and that gateway's Availability Zone fails, the other AZs can lose internet access. Preserve independent routing islands and required resilience; no consolidation is justified by this finding alone.
  2. Where the connected topology supports centralized egress, evaluate transit gateway or Cloud WAN routing together with NAT hourly/data processing, cross-AZ and transit gateway data processing charges. Peering connections cannot route traffic through a peer's NAT gateway. Compare measured traffic and availability needs before changing existing routes; public and private NAT gateways have different connectivity purposes, and an EIP applies only to public NAT.

Frameworks

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules