← All articles

Advanced Cloud Cost Optimization Strategy: Share Network Resources with AWS RAM

The hidden cost of duplicate network infrastructure

Most cloud‑cost reviews focus on compute and storage, but many teams overlook the expense of duplicated network components. A single NAT gateway in a VPC costs $0.045 per hour plus data processing fees. Multiply that by dozens of accounts in a multi‑account organization and the bill inflates quickly. The same applies to Transit Gateways, VPC endpoints, and even shared subnets. The advanced strategy covered here—using AWS Resource Access Manager (RAM) to share these network resources across accounts—can eliminate the redundant spend without compromising security or isolation.

Identify duplicate network resources in your organization

Before you can consolidate, you need a clear inventory of what exists in each account.

List NAT gateways per account

aws ec2 describe-nat-gateways \
    --query 'NatGateways[].[NatGatewayId, VpcId, State, CreateTime]' \
    --output table

Run the command in every account (or use AWS Organizations with aws sts assume-role) and capture the output to a CSV. Look for NAT gateways that serve a single AZ or a low‑traffic VPC.

List Transit Gateways per account

aws ec2 describe-transit-gateways \
    --query 'TransitGateways[].[TransitGatewayId, State, CreationTime]' \
    --output table

If you see more than one Transit Gateway per region, you likely have duplication.

List VPC endpoints per account

aws ec2 describe-vpc-endpoints \
    --query 'VpcEndpoints[].[VpcEndpointId, ServiceName, VpcId, State]' \
    --output table

Cross‑account services such as S3 or DynamoDB often have a dedicated endpoint per VPC, which can be consolidated.

Export the data for analysis

aws organizations list-accounts \
    --query 'Accounts[].[Id, Name]' \
    --output text > accounts.txt

Iterate over each account ID, assume a role, and run the three commands above, appending results to a master spreadsheet. Tag each row with the source account ID for later filtering.

Enable AWS RAM for network resource sharing

AWS RAM lets you share VPCs, subnets, Transit Gateways, and VPC endpoints with other AWS accounts or Organizational Units (OUs). The process is straightforward but requires careful permission management.

Step 1: Create a resource share

aws ram create-resource-share \
    --name "Shared-NAT-Transit" \
    --resource-arns arn:aws:ec2:us-east-1:111122223333:natgateway/nat-0a1b2c3d4e5f6g7h8 \
    --principals 222233334444 555566667777 \
    --allow-external-principals false

Replace the ARN with the NAT gateway you plan to share and list the account IDs that need access.

Step 2: Share a Transit Gateway

aws ram associate-resource-share \
    --resource-share-arn arn:aws:ram:us-east-1:111122223333:resource-share/abcd1234-ef56-78gh-90ij-klmnopqrstuv \
    --resource-arns arn:aws:ec2:us-east-1:111122223333:transit-gateway/tgw-0a1b2c3d4e5f6g7h8

You can add multiple ARNs (NAT, TGW, VPC endpoints) to the same share.

Step 3: Accept the share in the receiving account

aws ram accept-resource-share-invitation \
    --resource-share-invitation-arn arn:aws:ram:us-east-1:222233334444:resource-share-invitation/abcd1234-ef56-78gh-90ij-klmnopqrstuv

After acceptance, the shared resource appears in the receiving account’s console under VPC > NAT Gateways or Transit Gateways with a "Shared" badge.

Migrate workloads to the shared resources

Once the shared resources are visible, you need to re‑route traffic from the duplicate resources to the shared ones.

Re‑assign private subnets to the shared NAT gateway

1. Open the VPC console in the source account.
2. Select the subnet that currently uses a local NAT gateway.
3. Choose Edit route table.
4. Replace the existing NAT gateway ID with the shared NAT ARN (visible as nat-0a1b2c3d4e5f6g7h8 (Shared)).
5. Save changes.

Attach VPCs to the shared Transit Gateway

aws ec2 attach-transit-gateway-vpc-attachment \
    --transit-gateway-id tgw-0a1b2c3d4e5f6g7h8 \
    --vpc-id vpc-0a1b2c3d4e5f6g7h8 \
    --subnet-ids subnet-0123456789abcdef0 subnet-0fedcba9876543210

Repeat for each VPC that previously used its own TGW.

Update VPC endpoint DNS names

If you shared an S3 VPC endpoint, update the route tables of the consuming VPCs to point to the shared endpoint ID. The DNS name (s3.us-east-1.amazonaws.com) remains unchanged, so applications require no code change.

Verify the cost impact

After migration, confirm that the duplicate resources are no longer incurring charges.

Use Cost Explorer to compare before/after

1. Open Cost Explorer → Reports → Create report.
2. Filter by Usage Type NatGateway-Hours and the relevant account IDs.
3. Set the time range to the month before migration and the month after.
4. Export the chart as CSV for documentation.

Run CloudBudgetMaster’s free AWS waste finder

The free AWS waste finder scans your read‑only AWS environment and flags any remaining idle NAT gateways, unused TGWs, or orphaned VPC endpoints. Run it after migration to ensure nothing was missed.

Comparison: Duplicate vs. Shared network resources

The table shows that consolidating just a handful of NAT gateways can save hundreds of dollars per month without sacrificing network isolation.

Best practices and common pitfalls

Use AWS Organizations for permission hygiene

Create a dedicated OU (e.g., Shared-Network-Resources) and grant it the ram:CreateResourceShare and ram:AssociateResourceShare permissions. This prevents accidental sharing of resources to unauthorized accounts.

Tag shared resources consistently

Apply a tag like CostCenter=SharedNetwork and Owner=NetworkTeam. Tag‑based cost allocation makes it easy for the finance team to see the consolidated spend.

Monitor for orphaned resources

After migration, schedule a weekly Lambda that runs aws ec2 describe-nat-gateways and alerts on any NAT gateways in available state that are not attached to a route table.

Beware of cross‑region latency

Sharing a NAT gateway across regions is not possible; you must create a shared NAT per region. Plan your architecture accordingly to avoid cross‑region traffic spikes.

Document the share‑acceptance workflow

Because each receiving account must manually accept the share, maintain a simple checklist in your internal wiki. Automate acceptance with an IAM role that runs aws ram accept-resource-share-invitation for all pending invitations.

Frequently asked questions

How does sharing a NAT gateway affect security groups?

The NAT gateway itself does not have security groups; it operates at the subnet level. You still control inbound/outbound traffic with the subnet’s route table and the security groups attached to the instances.

Can I share a Transit Gateway across multiple AWS regions?

No. Transit Gateways are regional resources. You can share a TGW with accounts in the same region, but you need a separate TGW for each region you operate in.

Will shared VPC endpoints increase data transfer costs?

Data transfer pricing for VPC endpoints remains the same whether the endpoint is shared or dedicated. The cost savings come from eliminating duplicate endpoint hourly charges.

Is there a limit to how many accounts can accept a single resource share?

AWS RAM allows up to 100 accounts per resource share by default. You can request a limit increase if your organization exceeds this number.

Key takeaways

• Duplicate NAT gateways, Transit Gateways, and VPC endpoints are a hidden source of cloud spend.
• AWS RAM enables secure, cross‑account sharing of these network resources, eliminating redundancy.
• Inventory your network assets with aws ec2 describe-* commands before consolidating.
• Follow a disciplined share‑accept workflow and tag shared resources for clear cost allocation.
• Validate savings with Cost Explorer and the free AWS waste finder.
• CloudBudgetMaster automates the detection of idle and wasted AWS resources today, scanning read‑only accounts and reporting the dollar impact. GCP, Azure and Snowflake support are coming soon.