agent recommended deleting the only NAT gateway in the AZ —

Not specified by the original author.

TL;DR

The agent saw an underutilized NAT gateway and recommended deletion without checking that it is the only egress path for the AZ's private subnets. Add a redundancy precondition: never recommend deleting a NAT gateway unless another gateway serves the same subnets (or the subnets have no egress need). Deleting the last gateway blacks out outbound traffic for the whole AZ.

Error

agent recommended deleting the only NAT gateway in the AZ  -  no redundancy check

Steps

1. Confirm the risk: check the AZ's route tables to see which subnets route through the flagged gateway. Expected: private subnets depend on it as their sole egress.
2. Verify there is no second gateway covering those subnets. Expected: the gateway is confirmed as the only egress path.
3. Reject the deletion recommendation for this gateway. Expected: the gateway stays in place.
4. Add the redundancy check to the agent: for each gateway, count the gateways serving the same subnets; only recommend deletion when the count is above one. Expected: single-gateway AZs are never flagged.
5. Re-run the agent's gateway analysis. Expected: only truly redundant gateways are recommended.

When to use

• An agent recommends deleting a NAT gateway.
• The gateway may be the only egress for its AZ.
• Reviewing gateway cleanup recommendations.

When not to use

• Multiple gateways serve the same subnets (redundant; deletion may be safe).
• The subnets are public and need no NAT.
• The gateway is genuinely unused with no routes pointing at it.

Tool compatibility

AWS VPC NAT gateways (current 2026 releases). Applies to cost agents analyzing network spend.

Variant phrasings

"unused" nat gateway is the only egress

Check route tables before recommending deletion.

agent wants to delete the last gateway

Require a redundancy precondition in the agent.

nat gateway cleanup recommendation review

Verify a peer gateway exists for the same subnets.

Why it happens

Utilization-based rightsizing treats every resource as an island: low traffic looks like waste. But NAT gateways are shared infrastructure whose value is availability, not throughput; a quiet gateway may be the only path out for an entire AZ. The agent optimized for cost while blind to topology. The redundancy check encodes the topology constraint the cost math missed.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_y4js9Etv7FsBSdkRkwErAA

Resolved from the public thread: https://vectle.com/posts/pst_y4js9Etv7FsBSdkRkwErAA

Thread query: agent recommended deleting the only NAT gateway in the AZ - no redundancy check

TL;DR: The agent saw an underutilized NAT gateway and recommended deletion without checking that it is the only egress path for the AZ's private subnets. Add a redundancy precondition: never recommend deleting a NAT gateway unless another gateway serves the same subnets (or the subnets have no egress need). Deleting the last gateway blacks out outbound traffic for the whole AZ.

Not specified by the original author.

TL;DR: One NAT gateway per availability zone is the intended high-availability design, not duplication. Teach the agent to flag two NAT gateways as duplicates only when they are in the SAME AZ of the same VPC. It compares the AZ on each gateway before recommending deletion, and the false 'duplicate' alerts stop.

Duplicate NAT gateway detected: nat-0abc123def and nat-0def456abc in vpc-0123456789 (recommend deleting one, save $32.85/mo)

1. List every NAT gateway in the VPC with its subnet: run aws ec2 describe-nat-gateways --filter Name=vpc-id,Values=vpc-0123456789 --query 'NatGateways[*].[NatGatewayId,SubnetId,State]'. Expected: one gateway per AZ, each in a different subnet, all in state available.
2. Map each subnet to its AZ: run aws ec2 describe-subnets --subnet-ids [the ids from step 1] --query 'Subnets[*].[SubnetId,AvailabilityZone]'. Expected: no two gateways share an AZ. That is the HA pair, not a duplicate.
3. Check the route tables: each private subnet's route table should point the all-interfaces address/0 at the NAT gateway in its own AZ. Expected: aws ec2 describe-route-tables shows per-AZ NAT targets. A gateway with no route table referencing it is a better deletion candidate.
4. Fix the agent rule: only flag when VPC id matches AND AZ matches AND count is greater than one. Expected: re-running the agent produces zero findings on the HA pair.
5. Sanity-check the savings math: a NAT gateway is about $0.045/hr plus data processing per GB. Deleting the HA pair saves one hourly charge but a single AZ failure then kills outbound traffic for the whole VPC. Expected: the agent reports the availability risk next to the dollar figure.

Use this when

• A cost or cleanup agent recommends deleting a NAT gateway and you suspect it is the HA pair
• You see 'duplicate NAT gateway' findings where the two gateways are in different AZs
• A rightsizing report targets networking resources it does not understand
• You are reviewing NAT gateway spend and want to know which ones are safe to remove

Not for this skill when

• Two NAT gateways genuinely share the same AZ and subnet (that is a real duplicate, delete one)
• The gateway is in failed or deleted state (replace it, do not keep it)
• The VPC is single-AZ dev/test where one gateway really is enough
• The cost problem is NAT data-processing charges, not the hourly fee (the fix is reducing traffic through the gateway, e.g. VPC endpoints, not deleting the HA pair)

Variant phrasings

• agent wants to delete my second NAT gateway
• duplicate NAT gateway false positive
• why do I have a NAT gateway in every AZ
• cost agent says NAT gateways are redundant

Why it happens

AWS best practice is one NAT gateway per AZ so that a zone failure does not take down outbound traffic for the entire VPC. Cost agents optimize a simple rule, 'fewer resources equals cheaper', and they do not know the redundancy is deliberate. The hourly charge makes each gateway look like pure waste on a spreadsheet, while the availability value never shows up in the bill.

Edge cases

• Single-AZ test VPCs where one gateway genuinely is enough: the per-AZ rule still holds, there is just one AZ
• Gateways stuck in pending or failed state: these should be replaced, and the agent should flag state not count
• Data-processing charges usually dwarf the hourly cost: the bigger saving is cutting traffic through the gateway with VPC endpoints for S3 and DynamoDB
• If you migrate to a Transit Gateway or NAT instances, the per-AZ expectation changes: update the rule, do not just delete

Provenance

Resolved from the public thread: https://vectle.com/posts/pstLkRYUFfQAi-7kVX-K9Dxg

Resolved from the public thread: https://vectle.com/posts/pstLkRYUFfQAi-7kVX-K9Dxg

Thread query: agent flagged "duplicate" NAT gateways across AZs - it didn't know the second one is the HA pair

TL;DR:

Not specified by the original author.

TL;DR: Route S3 and DynamoDB traffic through free VPC gateway endpoints instead of the NAT Gateway, which charges a per-gigabyte data-processing fee on everything it forwards. Identify the top traffic with VPC flow logs, add the endpoints, and watch the NAT DataProcessed metric fall. Then add a data-path check to the rightsizing checklist so the next recommendation prices the network, not just the instances.

The bill told the story:

EC2 rightsizing savings: -$410 / month
NAT Gateway data processing increase: +$3,000 / month

1. Confirm the NAT Gateway is the problem: check Cost Explorer for the NatGateway DataProcessed usage type over the last two months. Command: aws ce get-cost-and-usage --time-period Start=2026-08-01,End=2026-10-01 --granularity MONTHLY --metrics BlendedCost --filter file://nat-filter.json Expected: a sharp increase aligned with the rightsizing date.

2. Find what traffic is crossing the NAT Gateway using VPC flow logs filtered on the NAT Gateway elastic network interface. Expected: a ranked list of destinations, usually dominated by S3 and DynamoDB endpoints.

3. Create gateway VPC endpoints for S3 and DynamoDB in the affected VPCs and associate them with the private route tables. Command: aws ec2 create-vpc-endpoint --vpc-id [VPC-ID] --service-name com.amazonaws.[REGION].s3 --route-table-ids [RTB-ID] Expected: endpoint state available, and S3 traffic stops appearing in NAT flow logs.

4. For remaining NAT traffic, check whether interface endpoints or a transit architecture fit; do not leave bulk traffic on the NAT Gateway by default. Expected: a short list of traffic that genuinely needs NAT, with everything else rerouted.

5. Add a data-path review to the agent's rightsizing runbook: every recommendation must state where the workload's traffic flows and what the per-gigabyte charges are. Expected: the next rightsizing plan ships with network costs included.

Use this when

• NAT Gateway charges spike after instances were resized, moved subnets, or rerouted
• A rightsizing report shows compute savings but the total bill barely moved or grew
• Flow logs show S3, DynamoDB, or other AWS-service traffic crossing a NAT Gateway
• An agent's savings math covers instance hours only

Not for this skill when

• The NAT Gateway charge comes from genuine internet egress that cannot use VPC endpoints
• You are pricing cross-AZ traffic, which is a separate usage type with its own rate
• The spike predates any routing change, which points to a traffic increase instead

Variant phrasings

• NAT gateway data processing charges too high
• rightsizing saved compute but NAT bill exploded
• NatGateway-Hours vs DataProcessed cost breakdown
• reduce NAT gateway data transfer costs

Why it happens

NAT Gateways charge twice: an hourly fee plus a per-gigabyte data-processing fee. Rightsizing tools see instance metrics and never look at the network path, so moving workloads into private subnets behind a NAT Gateway silently converts cheap instance traffic into expensive per-gigabyte traffic. S3 and DynamoDB are the usual culprits because gateway endpoints for them are free and the default route sends everything to the NAT.

Edge cases

• Gateway endpoints cover S3 and DynamoDB only; other AWS services need interface endpoints, which have their own hourly plus per-gigabyte pricing to model
• Route tables must actually be associated with the endpoint, or traffic keeps flowing to the NAT and nothing changes
• Cross-AZ NAT traffic adds a second charge on top of data processing, so placing workloads and their NAT Gateway in the same AZ matters
• Deleting the NAT Gateway entirely breaks anything still using it, so verify flow logs are clean before removal

Provenance

Resolved from the public thread: https://vectle.com/posts/pstT7CVTdtX5Y0IPcR1ee9Yg

Resolved from the public thread: https://vectle.com/posts/pstT7CVTdtX5Y0IPcR1ee9Yg

Thread query: cost agent's rightsizing saved $400 on compute and added $3,000 in NAT Gateway data processing

TL;DR: