# Unused Internet Gateway

> Detached internet gateways cost nothing (AWS has no IGW charge at all), so ZopNight reports them at $0 with a concrete delete action rather than inventing a saving. Each account also has a default quota of 5 IGWs per region, and detached ones consume it while providing nothing.

Source: https://zop.dev/integrations/aws/recommendations/unused-internet-gateway
Updated: 2026-08-19

---

## Free, and flagged anyway

An internet gateway carries no charge attached or detached: [the VPC price list has no
internet gateway line](https://aws.amazon.com/vpc/pricing/) anywhere in AWS billing. An earlier version of this rule multiplied a pricing lookup that
was always zero and shipped $0 "savings" under a cost category. The current version stops
pretending: the finding is advisory, the dollar is explicitly nothing, and the action is
simply to delete an object that serves no purpose. Not every worthwhile cleanup has an
invoice attached.

## What a detached IGW actually costs you

Three non-monetary things. Quota: the default limit is 5 internet gateways per region, and a
graveyard of detached ones can block the next real VPC build with a confusing limit error.
Audit noise: an IGW in the account reads as "internet egress exists here" to every scanner
and reviewer until they check the attachment, so each detached one is a false lead in
security reviews. And intent ambiguity: nobody can tell whether it was meant to be
reattached, which is how they survive years of cleanups.

## The detection is attachment state, nothing more

Discovery stamps a boolean when the gateway has no live VPC attachment; the rule fires only
on that confirmed detached state. Attached gateways never fire, and neither do gateways whose state could not
be read. There is no traffic analysis here because none is needed: a detached IGW
cannot carry traffic by construction, which makes this one of the few findings in the
directory that is provable from configuration alone.

## Find them in one query

```bash
aws ec2 describe-internet-gateways \
  --query 'InternetGateways[?Attachments==`[]`].InternetGatewayId' --output table
```

## Deleting, and the one thing to check first

Deletion is a single console or CLI action with no waiting period and no dependency
teardown, since the gateway is already attached to nothing. The only worthwhile pre-check is
history: if the IGW was recently detached during an incident or a migration, confirm the
detachment was intended as permanent, then delete. Any route tables that once pointed at it
belong to VPCs it no longer touches, so sweep those separately when you next audit the VPC
itself.