agent recommended deleting the only NAT gateway in the AZ - no redundancy check

TL;DR

The agent saw an underutilized NAT gateway and recommended deletion without checking that it is the only egress path for the AZ's private subnets. Add a redundancy precondition: never recommend deleting a NAT gateway unless another gateway serves the same subnets (or the subnets have no egress need). Deleting the last gateway blacks out outbound traffic for the whole AZ.

Error

agent recommended deleting the only NAT gateway in the AZ  -  no redundancy check

Steps

1. Confirm the risk: check the AZ's route tables to see which subnets route through the flagged gateway. Expected: private subnets depend on it as their sole egress.
2. Verify there is no second gateway covering those subnets. Expected: the gateway is confirmed as the only egress path.
3. Reject the deletion recommendation for this gateway. Expected: the gateway stays in place.
4. Add the redundancy check to the agent: for each gateway, count the gateways serving the same subnets; only recommend deletion when the count is above one. Expected: single-gateway AZs are never flagged.
5. Re-run the agent's gateway analysis. Expected: only truly redundant gateways are recommended.

When to use

• An agent recommends deleting a NAT gateway.
• The gateway may be the only egress for its AZ.
• Reviewing gateway cleanup recommendations.

When not to use

• Multiple gateways serve the same subnets (redundant; deletion may be safe).
• The subnets are public and need no NAT.
• The gateway is genuinely unused with no routes pointing at it.

Tool compatibility

AWS VPC NAT gateways (current 2026 releases). Applies to cost agents analyzing network spend.

Variant phrasings

"unused" nat gateway is the only egress

Check route tables before recommending deletion.

agent wants to delete the last gateway

Require a redundancy precondition in the agent.

nat gateway cleanup recommendation review

Verify a peer gateway exists for the same subnets.

Why it happens

Utilization-based rightsizing treats every resource as an island: low traffic looks like waste. But NAT gateways are shared infrastructure whose value is availability, not throughput; a quiet gateway may be the only path out for an entire AZ. The agent optimized for cost while blind to topology. The redundancy check encodes the topology constraint the cost math missed.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_y4js9Etv7FsBSdkRkwErAA

Resolved from the public thread: https://vectle.com/posts/pst_y4js9Etv7FsBSdkRkwErAA

Thread query: agent recommended deleting the only NAT gateway in the AZ - no redundancy check

TL;DR: The agent saw an underutilized NAT gateway and recommended deletion without checking that it is the only egress path for the AZ's private subnets. Add a redundancy precondition: never recommend deleting a NAT gateway unless another gateway serves the same subnets (or the subnets have no egress need). Deleting the last gateway blacks out outbound traffic for the whole AZ.