# Ensure Unused NAT Gateways Are Removed - Source: https://support.icompaas.com/support/solutions/articles/ensure-unused-nat-gateways-are-removed - Section: [Solutions](https://support.icompaas.com/support/solutions) › [DigitalOcean Cloud](https://support.icompaas.com/support/solutions/c_do_cloud) › [DigitalOcean Rules](https://support.icompaas.com/support/solutions/folders/digitalocean-rules) - Last updated: 2026-08-13 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ## Description This rule identifies VPC NAT Gateways that no longer sit on any active network path: none of the VPC's Droplets route their outbound traffic through the gateway and it is not set as the VPC's default route. A DigitalOcean VPC NAT Gateway is a paid, size-based service that centralizes outbound internet access for private VPC resources, so one that nothing routes through is pure recurring cost and extra topology to reason about. DigitalOcean does not expose AWS-style route-table associations or NAT flow logs. On DigitalOcean a NAT Gateway is judged in use by whether it is the VPC's default route and whether Droplets are configured to forward traffic to its routing-table IP; usage can be corroborated by the gateway's bandwidth/throughput metrics in the Control Panel. - VPC NAT Gateways not set as their VPC's default route and with no Droplets configured to use them. - NAT Gateways showing negligible outbound throughput over an extended period. ## Rationale A NAT Gateway is billed by size regardless of how much traffic it carries, so an idle one quietly accrues cost while adding a component every network review must account for. It also holds a public egress identity for the VPC; leaving one running when nothing routes through it widens the footprint an auditor or attacker must consider with no operational benefit. Removing gateways that are off the active path keeps the egress design minimal and intelligible, so the NAT Gateways that remain are all genuinely carrying VPC traffic. ## Impact Pros: - Stops recurring size-based charges for an idle gateway. - Simplifies the VPC egress topology reviewers must analyze. - Removes an unused public egress identity. Cons: - If any resource was quietly relying on the gateway for outbound access, deleting it breaks that egress until another path is configured. - Requires checking default-route and per-Droplet routing configuration, since DigitalOcean has no route-table-association object to query directly. ## Default Value A VPC NAT Gateway exists only if you explicitly create one; DigitalOcean does not provision or remove NAT Gateways automatically, and a gateway keeps billing by size until you delete it. ## Pre-Requisite - A DigitalOcean member with write access to VPC NAT Gateways. - Knowledge of which Droplets (or DOKS nodes) are configured to route egress through the gateway and whether it is the VPC default route. - doctl (with vpc-nat-gateway support) or an API token with NAT Gateway scope. ## Remediation ### Test Plan Using the DigitalOcean Control Panel: 1. In the Control Panel, go to Networking, then VPC, and open the NAT Gateway view (Actions > Create a NAT Gateway lists existing ones), or open a gateway's Overview tab to see its VPC. 2. Check whether the gateway is set as the VPC's default route and review its bandwidth/throughput metrics. 3. On the VPC's Droplets, check whether any are configured to route outbound traffic through the gateway's routing-table IP. 4. Pass: the gateway is the VPC default route and/or Droplets actively route egress through it, with corresponding throughput. 5. Fail: the gateway is not the default route, no Droplets route through it, and throughput is negligible over the review window. Using doctl or the API: List NAT Gateways and inspect their VPC and configuration. doctl compute vpc-nat-gateway list doctl compute vpc-nat-gateway get curl -s -H "Authorization: Bearer $DIGITALOCEAN\_TOKEN" "https://api.digitalocean.com/v2/vpc\_nat\_gateways" Pass: each listed gateway is the default route for its VPC or has Droplets configured to use it. Fail: a gateway has no default-route role and no resources configured to route through it; corroborate with negligible throughput before deleting. ### Implementation Steps Using the DigitalOcean Control Panel: 1. Confirm with the network owner that the gateway is off the active path and that no resource depends on it for egress. 2. On any Droplet still pointing at the gateway's routing-table IP, remove that route so it no longer forwards traffic to the gateway. 3. In Networking, then VPC / NAT Gateway, open the gateway and use its Destroy/Delete action, then confirm. Using doctl or the API: Delete an unused NAT Gateway via doctl or the API after clearing dependent routing. doctl compute vpc-nat-gateway delete curl -X DELETE -H "Authorization: Bearer $DIGITALOCEAN\_TOKEN" "https://api.digitalocean.com/v2/vpc\_nat\_gateways/" ### Backout Plan: 1. Deleting a NAT Gateway is irreversible; recreate one with doctl compute vpc-nat-gateway create (specifying the VPC and size) to restore centralized egress. 2. Re-add the gateway as the VPC default route and/or reconfigure Droplet routes to its new routing-table IP. ## References: 1. [How to Create a NAT Gateway](https://docs.digitalocean.com/products/networking/vpc/how-to/create-nat-gateway/) 2. [How to Configure Droplets for NAT Gateway](https://docs.digitalocean.com/products/networking/vpc/how-to/configure-droplet-nat-gateway/) 3. [doctl compute vpc-nat-gateway](https://docs.digitalocean.com/reference/doctl/reference/compute/vpc-nat-gateway/) 4. [VPC NAT Gateways API](https://docs.digitalocean.com/reference/api/reference/vpc-nat-gateways/) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.