🛡️ Azure NAT Gateway has no subnet🟢

• Contextual name: 🛡️ NAT Gateway has no subnet🟢
• ID: /ce/ca/azure/virtual-network/nat-gateway-without-subnet
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: COST

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure NAT Gateway
  • 🔌 Azure NAT Gateway - object.extracts.yaml
  • 🔌 Azure Network Subnet - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

An Azure NAT Gateway provides outbound connectivity only when it is associated with one or more subnets. A provisioned gateway without an active subnet association cannot route subnet traffic and can continue to incur NAT Gateway and public IP address or prefix charges.

Rationale

An unassociated NAT Gateway is usually unused infrastructure or an incomplete network deployment. Identifying it helps reduce avoidable cost and keeps the Azure network configuration aligned with its intended outbound-connectivity design.

Impact

Associating a NAT Gateway changes the outbound internet connectivity for resources in the selected subnet. Confirm the required outbound IP addresses, routing dependencies, and change window before associating or deleting the gateway.

Audit

This policy marks an Azure NAT Gateway as INCOMPLIANT if its Provisioning State is Succeeded and it has no related Azure Network Subnet with a Provisioning State of Succeeded.

An eligible gateway with at least one successfully provisioned related subnet is COMPLIANT. A gateway that is not successfully provisioned is INAPPLICABLE; missing gateway or related-subnet provisioning-state data is UNDETERMINED.

Remediation

Open File

Remediation

Associate the NAT Gateway with a Subnet

If the gateway is required for outbound connectivity, associate it with the intended subnet after confirming the required outbound IP addresses, routing dependencies, and affected workloads.

Azure portal

1. Open NAT gateways and select the NAT Gateway.
2. Select Subnets, then select the virtual network and subnet or subnets to associate.
3. Save the association and verify outbound connectivity from workloads in each subnet.

Azure CLI

az network vnet subnet update \
    --resource-group "{{resource-group-name}}" \
    --vnet-name "{{virtual-network-name}}" \
    --name "{{subnet-name}}" \
    --nat-gateway "{{nat-gateway-name}}"

Delete an Unused NAT Gateway

If the gateway is not required, delete it only after confirming that no current or planned workload depends on its outbound IP addresses.

az network nat gateway delete \
    --resource-group "{{resource-group-name}}" \
    --name "{{nat-gateway-name}}"

Considerations

• A NAT Gateway changes the outbound IP address used by associated subnets. Confirm firewall, allowlist, and partner integration requirements before association or deletion.

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 Cloudaware Framework → 💼 Waste Reduction			30		no data