AWSCostAWS cost · NAT gateway
Why your AWS NAT gateway is so expensive - and how to cut it
The NAT gateway is the line on an AWS bill that surprises people most. The advertised rate looks tiny - $0.045/GB - so nobody expects it to matter. Then the monthly total lands in the hundreds and nobody can say why. The reason is that the charges quietly stack, and most of what the gateway is processing never needed to go through it in the first place.
A NAT gateway costs about $33/month just to exist, then $0.045 for every GB it processes - and if that GB leaves AWS, another $0.09 of egress stacks on top. Most of the processed traffic is AWS-to-AWS calls to S3, DynamoDB, and ECR that never needed NAT. Route those through Gateway VPC endpoints and their processing charge drops to $0.
Where does the NAT gateway cost actually come from?
A NAT gateway bill is built from four separate charges (us-east-1 list pricing):
| Charge | Rate | What triggers it |
|---|---|---|
| NAT gateway, just running | ~$0.045/hr | ~$33/month per gateway |
| Data processing | $0.045/GB | every GB that passes through |
| Internet egress | +$0.09/GB | stacks on processing when the byte leaves AWS |
| Cross-AZ hop | +$0.01/GB | if the gateway is in another AZ |
The trap is the stacking. A single gigabyte that exits your VPC through the gateway and leaves AWS costs $0.045 + $0.09 = $0.135 - three times what the processing line alone suggests. Read the $0.045 rate and the bill still looks small. It is not.
Why is so much traffic going through the NAT gateway?
The single biggest source of unnecessary NAT cost is AWS-to-AWS traffic that does not need to touch the internet at all. From a private subnet, calls to S3, DynamoDB, ECR image pulls, and CloudWatch log pushes all route through the NAT gateway by default, and every byte is charged at the full processing rate. Nobody chose to send S3 traffic through NAT. It is just the default path when no endpoint exists.
How do I cut NAT gateway costs?
Start with Gateway VPC endpoints for S3 and DynamoDB. They have no hourly fee and no data processing charge, so traffic to those services stops touching NAT entirely. For an account routing 5 TB/month to S3, that is roughly $225/month in processing fees removed with zero application changes. For other AWS services, add Interface endpoints. And keep the gateway in the same Availability Zone as the instances that use it, so you do not pay the cross-AZ hop on top.
Creating the S3 Gateway endpoint is one command - point it at your VPC and route tables and S3 traffic stops touching NAT:
# free Gateway endpoint - S3 traffic bypasses the NAT gateway
aws ec2 create-vpc-endpoint \
--vpc-id vpc-xxxxxxxx \
--service-name com.amazonaws.us-east-1.s3 \
--route-table-ids rtb-xxxxxxxxShould I remove the NAT gateway entirely?
Only if nothing in the subnet needs the public internet. Once you have added VPC endpoints for the AWS services your workload calls, a private subnet that never reaches out to the internet does not need a NAT gateway at all - and you save the ~$33/month base charge as well as the processing. If some traffic genuinely goes to the internet, keep the gateway, but make sure it is only carrying the traffic that truly needs it.
Not sure how much of your NAT bill is avoidable? Connect your account read-only and see what it is wasting, in real dollars.
The role can only read - Get, Describe, List, nothing else. Read the exact permissions before you deploy it, and delete the stack whenever you want.
Frequently asked questions
Why is my NAT gateway so expensive?+
Two reasons. The charges compound - $0.045/GB processing plus $0.09/GB egress means a gigabyte leaving AWS costs about $0.135, three times the processing line alone. And most of the traffic is AWS-to-AWS calls (S3, DynamoDB, ECR, CloudWatch) that route through NAT by default but never needed it.
How much does an AWS NAT gateway cost per month?+
About $33/month just to keep one running (~$0.045/hour), before any traffic. On top of that you pay $0.045 for every GB processed, and another $0.09/GB if that data leaves AWS to the internet.
What is the difference between NAT gateway processing and data transfer charges?+
Processing ($0.045/GB) is charged on every byte that passes through the gateway, no matter where it goes. Data transfer (egress, $0.09/GB) is charged separately when that byte leaves AWS. They stack, so internet-bound traffic pays both.
How do VPC endpoints reduce NAT gateway costs?+
A Gateway VPC endpoint for S3 or DynamoDB routes that traffic directly out of your VPC with no hourly fee and no data processing charge. Traffic that used to pay $0.045/GB through NAT now pays $0. For an account pushing terabytes to S3, that is hundreds of dollars a month removed with no code change.
Do S3 and DynamoDB requests go through the NAT gateway?+
By default, yes - from a private subnet, S3 and DynamoDB API calls route through the NAT gateway and get charged at the full processing rate. Add a Gateway VPC endpoint for each and that traffic bypasses NAT entirely, for free.
Is a NAT instance cheaper than a NAT gateway?+
A self-managed NAT instance on a small EC2 can be cheaper for low, steady traffic, but you take on patching, failover, and a bandwidth ceiling. For most teams, the bigger win is cutting the traffic through NAT with VPC endpoints rather than swapping the gateway for an instance.
Can I run a private subnet without a NAT gateway?+
Yes, if nothing in the subnet needs to reach the public internet. Add VPC endpoints for the AWS services it does call (S3, DynamoDB, ECR, CloudWatch, and so on) and you can drop the NAT gateway completely for that subnet.
Related cost breakdowns
Why your AWS data transfer bill is so high - and how to cut it
Data transfer hides across three charges: $0.09/GB out to the internet, $0.045/GB through a NAT gateway, and $0.01/GB each way between AZs. Here is where it comes from and how to cut it.
Cross-AZ data transfer: the $0.01/GB charge draining HA setups
Traffic between Availability Zones costs $0.01/GB each way - $0.02 round trip. A chatty multi-AZ setup can quietly run $1,000+/month. Here is how to find it and cut it.
Idle load balancers cost ~$16/month each - even with zero traffic
An ALB or NLB with no traffic still bills about $16 to $22/month just to exist. Here is how to find load balancers with no healthy targets and shut them down.
Why AWS is charging you for public IPv4 addresses
Since February 2024 every public IPv4 address costs $0.005/hour (~$3.60/month), attached or idle. Idle Elastic IPs are pure waste. Here is how to find and release them.