NAT Gateway cost: the per-GB charge most teams never read.
A NAT Gateway has two charges: an hourly fee for each gateway, and a data-processing fee on every gigabyte that passes through it, about $0.045/GB in us-east-1. The per-GB fee is where the money goes. Most of that traffic is S3, DynamoDB, ECR and other AWS calls that a VPC endpoint carries for free or for much less. Here is how it is priced, how to find your number, and the fixes in order.
- NAT Gateway pricing has two parts: about $0.045 per hour per gateway (roughly $33 a month each) and about $0.045 per GB processed, in us-east-1. AWS charges data processing on every GB "regardless of the traffic's source or destination" (AWS VPC pricing page, checked 2026-10-10). The hourly fee is small; the per-GB fee scales with traffic you never see.
- The bill grows because private subnets send a lot of AWS-to-AWS traffic through NAT: S3 and DynamoDB reads, ECR image pulls, package updates, telemetry and AWS API calls. Gateway endpoints for S3 and DynamoDB have no hourly or data-processing charge and take that traffic off NAT. Interface endpoints for ECR, CloudWatch, Secrets Manager and STS cost about a quarter of the NAT per-GB rate.
- Find the spend in Cost Explorer (NatGateway-Bytes), attribute it with VPC Flow Logs, then deploy endpoints. You can do it in-house. If you want help, CloudRoute matches you with a vetted AWS partner for free.
IWhy NAT Gateway bills surprise people
A NAT Gateway gives private subnets outbound internet access without letting the internet reach in. It is the secure default, so the VPC wizard and most Terraform modules create one per Availability Zone, and nobody questions it.
The surprise is the billing model. NAT Gateway is a metered data-processing service, not flat-rate plumbing. You pay for the hours each gateway exists and for every gigabyte it processes. A private task does not announce that it just pulled a 1 GB image from ECR, or that your app reads terabytes from S3 through NAT instead of a free gateway endpoint. It all lands as one aggregated line on next month's bill.
Cutting it costs nothing in performance, availability or security. You are not trading anything away; you are stopping traffic from taking the expensive path.
IIHow NAT Gateway is priced
Two charges, added together. Rates vary by Region; the figures below are representative us-east-1 rates.
- Hourly charge (per gateway, per AZ): About $0.045/hour per NAT Gateway, billed whether or not traffic flows: roughly $33 a month per gateway, about $99 across three AZs. AWS also offers a regional NAT gateway option, billed per hour for each AZ it is configured in.
- Data-processing charge (per GB): About $0.045 for every gigabyte the gateway processes. Process 5 TB in a month and that is about $225; 50 TB is about $2,250.
Check the rates for your Region on the AWS VPC pricing page.
The data-processing charge stacks on top of normal data transfer. Send data to the internet through NAT and you pay NAT processing plus internet egress (about $0.09/GB at the first tier). Route a subnet in one AZ to a NAT Gateway in another and every byte also pays a cross-AZ charge.
You pay about $0.045/GB for every byte through a NAT Gateway, on top of any transfer cost the byte already has. The goal is not "make NAT cheaper"; it is "stop sending bytes through NAT that do not need to be there."
IIIWhere the gigabytes come from
When you attribute NAT traffic by destination, the same few patterns show up. Most of them are AWS-to-AWS traffic that never needed the internet path.
- S3 reads and writes: Apps in private subnets reading data lakes, assets, backups or model artifacts from S3 through NAT. S3 has a free gateway endpoint.
- ECR image pulls: Every ECS task, EKS pod or new EC2 host pulls its image on start. Large images pulled many times a day add up. ECR works through interface endpoints plus the S3 gateway endpoint.
- DynamoDB calls: DynamoDB also has a free gateway endpoint.
- OS and package updates: apt and yum updates, pip and npm installs, runtime downloads. Small each time, large across a fleet.
- Telemetry and logs: CloudWatch can move to an interface endpoint. Third-party SaaS egress needs the internet path; batch and compress it.
- Other AWS API calls: Secrets Manager, SSM, STS, SQS, SNS, Kinesis and KMS each have an interface endpoint.
IVHow to diagnose it: Cost Explorer, then VPC Flow Logs
You need two numbers before changing anything: how much you spend on NAT, and what traffic causes it.
Step 1: quantify the spend in Cost Explorer
Set monthly granularity over the last few months, filter to the EC2-Other usage type group and group by Usage Type. NAT shows as NatGateway-Hours and NatGateway-Bytes. If Bytes dwarfs Hours (it usually does), your problem is traffic and VPC endpoints are the lever. If both are small, look for idle gateways in unused AZs or dev VPCs. Add a Cost Anomaly Detection monitor or budget alert so the next spike is flagged.
Step 2: attribute the traffic with VPC Flow Logs
Enable Flow Logs (publishing to S3 is cheaper to analyze), filter to flows through the NAT Gateway's network interface, and query them with Athena: group bytes by destination address and port, sorted descending. Map the top destinations to AWS services using the published AWS IP ranges. Each AWS service near the top is an endpoint to deploy.
VThe four fixes, in priority order
The first fix alone often removes most of the data-processing spend.
Fix 1: gateway endpoints for S3 and DynamoDB (free)
Add a gateway VPC endpoint for S3 and DynamoDB and attach it to your private route tables. AWS says there are "no data processing or hourly charges" for gateway endpoints (VPC pricing, checked 2026-10-10). That traffic then stays on the AWS network and stops paying NAT processing. Lock the endpoint down with a policy.
Fix 2: interface endpoints for ECR, CloudWatch, Secrets Manager, STS
Most other AWS services are reachable through interface endpoints (AWS PrivateLink). Each costs about $0.01 per hour per AZ plus about $0.01/GB, roughly a quarter of the NAT per-GB rate. Add them for the busy services in your Flow Logs ranking and skip the long tail where the hourly fee would exceed the savings. ECR needs its API interface endpoints plus the S3 gateway endpoint, because image layers live in S3.
Fix 3: fix route-table and AZ mistakes (free)
Point each subnet at the NAT Gateway in its own AZ, so bytes stop paying a cross-AZ charge on top. In dev and staging, one gateway instead of three saves the hourly fees if you accept that an AZ outage takes the environment down. Never do this in production.
Fix 4: a NAT instance for low-traffic dev, or less traffic
For low-traffic, non-critical environments, a small self-managed NAT instance (Graviton is cheapest) avoids the per-GB processing fee. You own patching, it is a single point of failure unless you build HA, and bandwidth does not scale on its own. Use it in dev and test only.
The deepest lever is less traffic: a pull-through cache or private artifact repository instead of re-downloading dependencies on every build, and fewer polling integrations.
VIA worked example
A hypothetical startup VPC with three NAT Gateways processing 30 TB a month: 14 TB S3, 6 TB ECR, 4 TB DynamoDB, 3 TB other AWS APIs and telemetry, and 3 TB of real internet traffic. Representative us-east-1 rates.
- Before: Hourly: 3 × ~$33 = ~$99/mo. Data processing: 30,000 GB × ~$0.045 = ~$1,350/mo.
- After Fix 1 (S3 and DynamoDB gateway endpoints): 18 TB leaves the NAT path at no charge. NAT processing drops to 12,000 GB × $0.045 = ~$540/mo.
- After Fix 2 (ECR and telemetry interface endpoints): 9 TB moves to interface endpoints at ~$0.01/GB (~$90/mo plus hourly endpoint fees). NAT now carries only the 3 TB of internet traffic: ~$135/mo of processing.
Processing for this traffic falls from about $1,350 a month to a few hundred dollars all-in, with no change to availability, performance or security. Most of the saving comes from the free gateway endpoints. Your Region and traffic mix change the numbers, not the shape.
VIIDoing it yourself, or with a partner
All of this is doable in-house if someone has time to read Flow Logs and change routes without breaking connectivity. If not, a partner can do it.
CloudRoute matches you with one vetted AWS partner that fits. The partner quantifies NAT spend in Cost Explorer, attributes it with Flow Logs, deploys the endpoints, fixes route tables and tests in staging. The same review usually finds nearby savings: wider data-transfer waste, idle resources, right-sizing and commitment coverage.
Who pays: a NAT cleanup on its own is normal paid work, and the monthly savings pay for it. AWS funding that a partner can file comes through three routes: MAP when you migrate to AWS, POC when you test something, and incremental workload (IW) funding when you launch new work on AWS. If your network work is part of one of those, the partner checks whether it qualifies: typically $50K to $150K for startups. Depends on the workload; AWS approves. CloudRoute is free for startups; partners pay CloudRoute a monthly membership plus 10% of AWS-approved funding.
NAT Gateway vs VPC endpoints vs NAT instance
You will usually run a mix: AWS-to-AWS traffic on VPC endpoints, real internet traffic on NAT, and low-traffic dev on a NAT instance if it pays. Rates are representative us-east-1 figures.
| Dimension | NAT Gateway (managed) | VPC endpoints (gateway / interface) | NAT instance (self-managed) |
|---|---|---|---|
| What it is for | Outbound internet access for private subnets | A private path to specific AWS services | Outbound internet through a small EC2 instance |
| Hourly cost | ~$0.045/hr per gateway, per AZ | Gateway: $0. Interface: ~$0.01/hr per endpoint, per AZ | The EC2 instance (a few dollars a month for a small one) |
| Data processing | ~$0.045/GB on every byte | Gateway: $0/GB. Interface: ~$0.01/GB | None beyond normal data transfer |
| Reaches the internet? | Yes | No, AWS services only | Yes |
| High availability | Managed, one per AZ | Managed | You build it |
| Operational burden | None | None | You patch, monitor and scale it |
| Best for | Real internet egress to third parties | All AWS-to-AWS traffic | Low-traffic dev and test |
How a match works (example)
- You tell us about the work
You fill in a short form: what you run today, what you want to move, test or build, your stage and your region.
- We pick one partner
We read your answers and pick one vetted AWS consulting partner that fits the work, the stack and the region. We reply within 24 hours; your matched partner reaches out within 5 business days.
- The partner checks which funding fits
Your matched partner scopes the work with you. Then it checks which partner-filed funding fits: MAP if you are moving to AWS, POC if you want to test something, or incremental workload (IW) funding if you are already on AWS and launching new work.
- The partner files, AWS decides
If the work qualifies, the partner files the funding request with AWS. AWS reviews it and decides. The amount depends on the workload.
- You pay nothing
CloudRoute is free for startups. Partners pay CloudRoute a monthly membership plus 10% of AWS-approved funding.
AWS Activate credits are separate, and you apply for them yourself. Use Activate Founders if no investor backs you. Use Activate Portfolio with the Org ID or invite from your VC, accelerator, incubator or angel group if it is an Activate Provider. A consulting partner cannot apply for Activate on your behalf.
Common questions
How much does a NAT Gateway cost?
Why is my NAT Gateway bill so high?
How do I reduce NAT Gateway costs?
What is the difference between a gateway endpoint and an interface endpoint?
Should I replace my NAT Gateway with a NAT instance?
Can AWS pay for a NAT Gateway cleanup?
Find out how much of your bill is NAT Gateway, and cut it
CloudRoute matches you with a vetted AWS partner who audits your NAT spend, deploys the endpoints and fixes the route tables. CloudRoute is free for startups.