diff --git a/deployment/terraform/azure/observers/variables.tf b/deployment/terraform/azure/observers/variables.tf
index f3bb5a729..77350d4bd 100644
--- a/deployment/terraform/azure/observers/variables.tf
+++ b/deployment/terraform/azure/observers/variables.tf
@@ -30,6 +30,12 @@ variable "resource_suffix" {
   default     = null
 }
 
+variable "enable_nay_gw" {
+  description = "Enables NAT gw creation"
+  type        = bool
+  default     = false
+}
+
 variable "enable_encryption_at_host" {
   description = "Enables encryption at host for the node's managed disks"
   type        = bool
diff --git a/deployment/terraform/azure/observers/vpc.tf b/deployment/terraform/azure/observers/vpc.tf
index 086ba1319..83ab6f10a 100644
--- a/deployment/terraform/azure/observers/vpc.tf
+++ b/deployment/terraform/azure/observers/vpc.tf
@@ -20,6 +20,8 @@ resource "azurerm_subnet_network_security_group_association" "this" {
 }
 
 resource "azurerm_nat_gateway" "this" {
+  count = var.enable_nay_gw ? 1 : 0
+
   name                = "${local.resource_prefix}-vnet-nat-gw"
   resource_group_name = local.resource_group_name
   location            = local.location
@@ -28,11 +30,15 @@ resource "azurerm_nat_gateway" "this" {
 }
 
 resource "azurerm_subnet_nat_gateway_association" "this" {
+  count = var.enable_nay_gw ? 1 : 0
+
   subnet_id      = azurerm_subnet.this.id
-  nat_gateway_id = azurerm_nat_gateway.this.id
+  nat_gateway_id = azurerm_nat_gateway.this[0].id
 }
 
 resource "azurerm_public_ip" "nat_gw" {
+  count = var.enable_nay_gw ? 1 : 0
+
   name                = "${local.resource_prefix}-nat-gw-public-ip"
   location            = local.location
   resource_group_name = local.resource_group_name
@@ -43,6 +49,8 @@ resource "azurerm_public_ip" "nat_gw" {
 }
 
 resource "azurerm_nat_gateway_public_ip_association" "this" {
-  nat_gateway_id       = azurerm_nat_gateway.this.id
-  public_ip_address_id = azurerm_public_ip.nat_gw.id
+  count = var.enable_nay_gw ? 1 : 0
+
+  nat_gateway_id       = azurerm_nat_gateway.this[0].id
+  public_ip_address_id = azurerm_public_ip.nat_gw[0].id
 }
diff --git a/deployment/terraform/azure/private-sentries/variables.tf b/deployment/terraform/azure/private-sentries/variables.tf
index 210fdb4c5..3e519cec5 100644
--- a/deployment/terraform/azure/private-sentries/variables.tf
+++ b/deployment/terraform/azure/private-sentries/variables.tf
@@ -14,6 +14,12 @@ variable "location" {
   default     = null
 }
 
+variable "enable_nay_gw" {
+  description = "Enables NAT gw creation"
+  type        = bool
+  default     = false
+}
+
 variable "enable_encryption_at_host" {
   description = "Enables encryption at host for the node's managed disks"
   type        = bool
diff --git a/deployment/terraform/azure/private-sentries/vpc.tf b/deployment/terraform/azure/private-sentries/vpc.tf
index a7487409b..ba6725748 100644
--- a/deployment/terraform/azure/private-sentries/vpc.tf
+++ b/deployment/terraform/azure/private-sentries/vpc.tf
@@ -20,6 +20,8 @@ resource "azurerm_subnet_network_security_group_association" "this" {
 }
 
 resource "azurerm_nat_gateway" "this" {
+  count = var.enable_nay_gw ? 1 : 0
+
   name                = "private-sentries-vnet-nat-gw"
   resource_group_name = local.resource_group_name
   location            = local.location
@@ -28,11 +30,15 @@ resource "azurerm_nat_gateway" "this" {
 }
 
 resource "azurerm_subnet_nat_gateway_association" "this" {
+  count = var.enable_nay_gw ? 1 : 0
+
   subnet_id      = azurerm_subnet.this.id
-  nat_gateway_id = azurerm_nat_gateway.this.id
+  nat_gateway_id = azurerm_nat_gateway.this[0].id
 }
 
 resource "azurerm_public_ip" "nat_gw" {
+  count = var.enable_nay_gw ? 1 : 0
+
   name                = "private-sentries-nat-gw-public-ip"
   location            = local.location
   resource_group_name = local.resource_group_name
@@ -43,6 +49,8 @@ resource "azurerm_public_ip" "nat_gw" {
 }
 
 resource "azurerm_nat_gateway_public_ip_association" "this" {
-  nat_gateway_id       = azurerm_nat_gateway.this.id
-  public_ip_address_id = azurerm_public_ip.nat_gw.id
+  count = var.enable_nay_gw ? 1 : 0
+
+  nat_gateway_id       = azurerm_nat_gateway.this[0].id
+  public_ip_address_id = azurerm_public_ip.nat_gw[0].id
 }
diff --git a/deployment/terraform/azure/public-sentries/variables.tf b/deployment/terraform/azure/public-sentries/variables.tf
index 2c0ada215..aba6de8f4 100644
--- a/deployment/terraform/azure/public-sentries/variables.tf
+++ b/deployment/terraform/azure/public-sentries/variables.tf
@@ -24,6 +24,12 @@ variable "resource_suffix" {
   default     = null
 }
 
+variable "enable_nay_gw" {
+  description = "Enables NAT gw creation"
+  type        = bool
+  default     = false
+}
+
 variable "enable_encryption_at_host" {
   description = "Enables encryption at host for the node's managed disks"
   type        = bool
diff --git a/deployment/terraform/azure/public-sentries/vpc.tf b/deployment/terraform/azure/public-sentries/vpc.tf
index e4acf683b..56946bafd 100644
--- a/deployment/terraform/azure/public-sentries/vpc.tf
+++ b/deployment/terraform/azure/public-sentries/vpc.tf
@@ -22,6 +22,8 @@ resource "azurerm_subnet_network_security_group_association" "this" {
 }
 
 resource "azurerm_nat_gateway" "this" {
+  count = var.enable_nay_gw ? 1 : 0
+
   name                = "${local.resource_prefix}-vnet-nat-gw"
   resource_group_name = local.resource_group_name
   location            = local.location
@@ -30,11 +32,15 @@ resource "azurerm_nat_gateway" "this" {
 }
 
 resource "azurerm_subnet_nat_gateway_association" "this" {
+  count = var.enable_nay_gw ? 1 : 0
+
   subnet_id      = azurerm_subnet.this.id
-  nat_gateway_id = azurerm_nat_gateway.this.id
+  nat_gateway_id = azurerm_nat_gateway.this[0].id
 }
 
 resource "azurerm_public_ip" "nat_gw" {
+  count = var.enable_nay_gw ? 1 : 0
+
   name                = "${local.resource_prefix}-nat-gw-public-ip"
   location            = local.location
   resource_group_name = local.resource_group_name
@@ -45,6 +51,8 @@ resource "azurerm_public_ip" "nat_gw" {
 }
 
 resource "azurerm_nat_gateway_public_ip_association" "this" {
-  nat_gateway_id       = azurerm_nat_gateway.this.id
-  public_ip_address_id = azurerm_public_ip.nat_gw.id
+  count = var.enable_nay_gw ? 1 : 0
+
+  nat_gateway_id       = azurerm_nat_gateway.this[0].id
+  public_ip_address_id = azurerm_public_ip.nat_gw[0].id
 }
diff --git a/deployment/terraform/azure/validator/variables.tf b/deployment/terraform/azure/validator/variables.tf
index d0f011ff6..4898ee486 100644
--- a/deployment/terraform/azure/validator/variables.tf
+++ b/deployment/terraform/azure/validator/variables.tf
@@ -14,6 +14,12 @@ variable "location" {
   default     = null
 }
 
+variable "enable_nay_gw" {
+  description = "Enables NAT gw creation"
+  type        = bool
+  default     = false
+}
+
 variable "enable_encryption_at_host" {
   description = "Enables encryption at host for the node's managed disks"
   type        = bool
diff --git a/deployment/terraform/azure/validator/vpc.tf b/deployment/terraform/azure/validator/vpc.tf
index 4f8680f06..99fba7a0f 100644
--- a/deployment/terraform/azure/validator/vpc.tf
+++ b/deployment/terraform/azure/validator/vpc.tf
@@ -20,6 +20,8 @@ resource "azurerm_subnet_network_security_group_association" "this" {
 }
 
 resource "azurerm_nat_gateway" "this" {
+  count = var.enable_nay_gw ? 1 : 0
+
   name                = "validator-vnet-nat-gw"
   resource_group_name = local.resource_group_name
   location            = local.location
@@ -28,11 +30,15 @@ resource "azurerm_nat_gateway" "this" {
 }
 
 resource "azurerm_subnet_nat_gateway_association" "this" {
+  count = var.enable_nay_gw ? 1 : 0
+
   subnet_id      = azurerm_subnet.this.id
-  nat_gateway_id = azurerm_nat_gateway.this.id
+  nat_gateway_id = azurerm_nat_gateway.this[0].id
 }
 
 resource "azurerm_public_ip" "nat_gw" {
+  count = var.enable_nay_gw ? 1 : 0
+
   name                = "validator-nat-gw-public-ip"
   location            = local.location
   resource_group_name = local.resource_group_name
@@ -43,6 +49,8 @@ resource "azurerm_public_ip" "nat_gw" {
 }
 
 resource "azurerm_nat_gateway_public_ip_association" "this" {
-  nat_gateway_id       = azurerm_nat_gateway.this.id
-  public_ip_address_id = azurerm_public_ip.nat_gw.id
+  count = var.enable_nay_gw ? 1 : 0
+
+  nat_gateway_id       = azurerm_nat_gateway.this[0].id
+  public_ip_address_id = azurerm_public_ip.nat_gw[0].id
 }