NAT Gateway with no traffic

What's the problem

BytesOutToDestination < 1 GB/day for 14 days → fixed charge $0.045/hr (~$32/mo)

How 6WAF detects it

• The threshold and data source are stated in the description above (CloudWatch metrics / AWS API describe calls) — this is the checker logic that runs in the scan, not separate marketing copy.
• Scanning uses a read-only IAM Role you deploy yourself (CloudFormation) — 6WAF stores no credentials, and you revoke access any time by deleting the stack.
• Unit prices used for estimates have a published source and an as-of date (us-east-1 baseline) — figures are a conservative lower bound, not inflated.