Strategy

Cut Duplicate Cloud Infrastructure with Resource Sharing

July 06, 2026·5 min read·CloudBudgetMaster

Why Duplicate Infrastructure Bleeds Money

Most teams treat each project or environment as a silo and spin up its own VPC, subnet, NAT gateway, or even a dedicated bastion host. The cost impact is easy to miss because each piece is small:

A NAT gateway in AWS costs $32 per month per AZ.
A Cloud NAT in GCP adds $0.004 per GB of processed traffic.
An Azure Load Balancer (Standard) starts at $18 per month.

When you have five environments, that’s $150‑$200 of recurring spend that never directly contributes to business value. The underlying problem isn’t the services themselves; it’s the duplication of networking and support resources across accounts, projects, or subscriptions.

Step 1: Inventory All Network‑Level Resources

Start with a read‑only scan of each cloud provider. Use the native CLI to dump the list of VPCs, subnets, NATs, and bastion hosts.

# AWS
aws ec2 describe-vpcs --query 'Vpcs[*].{Id:VpcId,Name:Tags[?Key==`Name`].Value|[0]}'
aws ec2 describe-nat-gateways --query 'NatGateways[*].{Id:NatGatewayId,Vpc:VpcId,State:State}'

# GCP
gcloud compute networks list --format='table(name,subnetMode,autoCreateSubnetworks)'
gcloud compute routers list --format='table(name,network,region)'

# Azure
az network vnet list -o table
az network nat gateway list -o table

Export the output to CSV or JSON and load it into a spreadsheet. Tag each row with the owning team, environment (dev/stage/prod), and purpose. This visual map reveals where multiple teams are running identical resources.

Step 2: Identify Candidates for Sharing

Look for patterns such as:

Multiple VPCs with identical CIDR blocks (often a copy‑paste mistake).
Separate NAT gateways per environment when traffic can be routed through a single shared NAT.
Bastion hosts or jump boxes duplicated across accounts.
Load balancers that front the same internal service (e.g., a shared API gateway).

Prioritize items that have a clear cost line item and are not bound by compliance isolation requirements.

Step 3: Consolidate Using Provider‑Specific Sharing Features

AWS – Resource Access Manager (RAM)

AWS RAM lets you share VPC subnets, Transit Gateways, and even License Manager configurations across accounts.

# Create a resource share for a VPC subnet
aws ram create-resource-share \
  --name "Shared-Prod-Subnet" \
  --resource-arns arn:aws:ec2:us-east-1:123456789012:subnet/subnet-0a1b2c3d4e5f6g7h \
  --principals 111122223333 444455556666

# Accept the share in the receiving account
aws ram accept-resource-share-invitation \
  --resource-share-invitation-arn arn:aws:ram:us-east-1:111122223333:resource-share-invitation/abcd-1234-efgh-5678

After acceptance, the receiving account can launch resources into the shared subnet without creating its own NAT gateway. Delete the now‑redundant NATs with:

aws ec2 delete-nat-gateway --nat-gateway-id nat-0a1b2c3d4e5f6g7h

GCP – Shared VPC

Shared VPC lets a host project own the network while service projects consume it.

# Enable Shared VPC on the host project
gcloud compute shared-vpc enable my-host-project

# Associate a service project
gcloud compute shared-vpc associated-projects add my-service-project \
  --host-project=my-host-project

Migrate subnets and Cloud NAT from the service project to the host project, then remove the original resources:

# Delete the service‑project NAT
gcloud compute routers delete my-nat-router --project=my-service-project --region=us-central1

Azure – Virtual Network Peering & Private Link

Azure does not have a direct “shared VPC” concept, but you can achieve the same effect with VNet peering and Private Link.

# Create a hub VNet (central networking)
az network vnet create -g HubRG -n HubVNet --address-prefix 10.0.0.0/16

# Peer a spoke VNet to the hub
az network vnet peering create -g SpokeRG -n SpokeToHub \
  --vnet-name SpokeVNet --remote-vnet HubVNet \
  --allow-forwarded-traffic true --allow-gateway-transit true

Move NAT gateways or Azure Firewall to the hub VNet and delete the duplicates in each spoke:

az network nat gateway delete -g SpokeRG -n SpokeNatGateway

Step 4: Refactor IAM and Tag Policies

Shared resources must be governed tightly. Apply the following guardrails:

Tag inheritance: Enforce a shared:true tag on all shared objects.
IAM conditions: Use policy conditions like aws:ResourceTag/shared to restrict who can modify shared assets.
Cost allocation tags: Tag each usage with the consuming team’s name so you can still attribute spend.

Example IAM policy snippet for AWS:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["ec2:CreateNetworkInterface"],
      "Resource": "*",
      "Condition": {"StringEquals": {"aws:RequestTag/shared": "true"}}
    }
  ]
}

Step 5: Automate Ongoing Validation

Add a scheduled script (e.g., a Lambda, Cloud Function, or Azure Function) that runs the inventory commands from Step 1, compares the current state to a baseline, and raises an alert if a new duplicate is detected.

# Example CloudWatch Event to trigger a Lambda every 24h
aws events put-rule --schedule-expression "rate(1 day)" --name "DetectDuplicateVPCs"
aws lambda add-permission --function-name DetectDuplicateVPCs --principal events.amazonaws.com --statement-id "AllowEvent" --action "lambda:InvokeFunction"

The alert can be a Slack message, an email, or a ticket in your incident system.

Real‑World Impact

When a mid‑size SaaS migrated three dev VPCs into a single shared VPC on AWS, they eliminated two NAT gateways and one bastion host, cutting $96 per month from the bill. In GCP, consolidating Cloud NAT across four projects saved roughly $150 per month. Azure’s hub‑spoke model removed three redundant Standard Load Balancers, saving $54 per month. The combined effect was a 15‑20% reduction in networking‑related spend without any loss of security or isolation.

How CloudBudgetMaster Automates This

CloudBudgetMaster continuously scans your AWS, GCP, and Azure accounts, flags duplicate VPCs, NAT gateways, and bastion hosts, and shows the exact dollar impact. With one click you can generate a migration plan that uses native sharing features (RAM, Shared VPC, VNet peering) and track the savings as they materialize.