LOW
NAT Gateway Usage
nat-gateway-usage
What this rule checks
Identifies NAT Gateway usage for cost awareness.
How to fix it
- 1Consider VPC endpoints to reduce NAT Gateway traffic
- 2Use NAT instances for lower traffic volumes
FlaggedA default ec2.Vpc creates managed NAT Gateways for its private subnets. The check flags every AWS::EC2::NatGateway for cost awareness: each incurs an hourly charge plus per-GB data-processing fees.
import { App, Stack } from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
// FLAGGED: default VPC provisions a managed NAT Gateway per AZ.
new ec2.Vpc(this, 'Vpc');FixedSetting natGateways: 0 removes the managed NAT Gateways entirely, so there are no AWS::EC2::NatGateway resources to flag. Private-subnet access to AWS services is provided through cheaper VPC endpoints.
import { App, Stack } from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
// FIXED: no NAT Gateways; reach AWS services via VPC endpoints instead.
const vpc = new ec2.Vpc(this, 'Vpc', { natGateways: 0 });
vpc.addGatewayEndpoint('S3', { service: ec2.GatewayVpcEndpointAwsService.S3 });CDK Insights pinpoints the exact file and line in your CDK source for every finding, so you can jump straight to the fix.
Affected resource types
AWS::EC2::NatGatewayIntentional? Suppress this finding
Sometimes a flag is deliberate — a genuinely public endpoint, say. You can dismiss nat-gateway-usage and the reason is kept in the report, not silently hidden.
In .cdk-insights.json:
{
"ignoreRules": [
{ "id": "nat-gateway-usage", "reason": "Why this is intentional" }
]
}Or inline in your CDK code:
Validations.of(scope).acknowledge({
id: 'cdk-insights::nat-gateway-usage',
reason: 'Why this is intentional',
});Use the rule ID nat-gateway-usage shown above — not the CDK-* ID from SARIF / GitHub code scanning. To dismiss every finding on one construct instead, use ignorePaths. Suppression docs →
Catch this in your stack
$ npx cdk-insights scanCDK Insights runs this and 118+ other rules locally against your synthesised CDK app — free, no account, your code never leaves your machine.